wgc@0.131.2
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe source shows an explicit plugin scaffolding command that creates a Cursor rules directory, a first-party package-owned agent setup behavior that warrants a warning. No install lifecycle hook or concrete malicious attack was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the router plugin init command.
Impact
The generated plugin includes an AI-agent configuration location; source evidence does not establish broader control-surface mutation or malicious behavior.
Mechanism
The scaffolder creates a .cursor/rules directory in its temporary plugin tree, which is then moved into the generated plugin directory.
AI rationale
The source shows an explicit plugin scaffolding command that creates a Cursor rules directory, a first-party package-owned agent setup behavior that warrants a warning. No install lifecycle hook or concrete malicious attack was identified.
Evidence
dist/src/commands/router/commands/plugin/commands/init.js.cursor/rules
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI entrypoint and has no install lifecycle hook in its scripts.
- The plugin init command is explicitly invoked and scaffolds a gRPC router plugin.
- That command creates a Cursor rules directory as part of the generated plugin.
- Telemetry is disabled by the documented opt-out environment flags.
Evidence against
- No automatic install-time mutation or concrete attack was identified.
- The AI-agent-related write is limited to scaffolding invoked through the CLI.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/src/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.131.2.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.131.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.