wgc@0.133.0
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe scanner’s agent-configuration finding is an explicit, project-scoped scaffold operation, and its generated Cursor rule is not set to apply automatically. The remaining network and credential signals resolve to product telemetry and authentication against configured WunderGraph services.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI startup runs telemetry; the Cursor rule is generated only when the user invokes plugin initialization.
Impact
No unauthorized credential transfer or agent-control change was found.
Mechanism
The CLI sends usage and failure events to its configured telemetry collector. Plugin initialization writes generated project files, including a Cursor rule that is marked not to apply automatically.
AI rationale
The scanner’s agent-configuration finding is an explicit, project-scoped scaffold operation, and its generated Cursor rule is not set to apply automatically. The remaining network and credential signals resolve to product telemetry and authentication against configured WunderGraph services.
Network endpoints3
eu.i.posthog.comaccounts.wundergraph.com/authcosmo-cp.wundergraph.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has no npm install lifecycle hook; the entrypoint starts telemetry and parses CLI commands.
- The flagged plugin setup runs as an explicit scaffolding command and writes a project-local Cursor development rule marked not to apply automatically.
- Authentication refreshes use the configured WunderGraph identity endpoint, and command families check authentication before their actions.
- Telemetry supports opt-out and sends command usage and failure details to the configured PostHog collector.
- The demo source hits are onboarding events and demo workflow calls, not credential-transfer behavior.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
2 High3 Medium7 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to wgc@0.133.0.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.133.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.