wgc@0.133.2
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 14d ago · by lpm-firewall-aiDefault telemetry sends command details and authenticated account identity to a publisher-selected analytics host, creating a conditional data exposure risk when sensitive values appear in command inputs or errors. The flagged agent configuration behavior is part of an explicit scaffolding command and does not independently indicate abuse.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI with telemetry enabled; command events are captured during command execution and failures are captured by the entrypoint.
Impact
Command supplied values and account identifying information may be disclosed to the analytics recipient; sensitive values embedded in errors may also be included.
Mechanism
The CLI gathers command paths, arguments, and options, retrieves the authenticated account email, adds machine and platform metadata, and submits events to the default PostHog host. Telemetry can be disabled through environment variables.
AI rationale
Default telemetry sends command details and authenticated account identity to a publisher-selected analytics host, creating a conditional data exposure risk when sensitive values appear in command inputs or errors. The flagged agent configuration behavior is part of an explicit scaffolding command and does not independently indicate abuse.
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI initializes telemetry before parsing commands and sends events to a default PostHog host unless telemetry is disabled.
- Command events include the full command path, options, and arguments, which may contain user supplied values.
- When authenticated, telemetry retrieves the account email and uses it as the event identifier; failure events also include error messages and stack traces.
Evidence against
- The package has no install lifecycle hooks; its entrypoint is a CLI.
- The flagged plugin initializer is an explicit scaffolding command that creates project files and local editor rules.
- Telemetry can be disabled with COSMO_TELEMETRY_DISABLED or DO_NOT_TRACK.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L962return;
}
const posthogApiKey = process.env.POSTHOG_API_KEY || 'phc_CEnvoyw3KcTuC5E1seDPrgvAamgGRDLfzPi1e7RU1G1';
const posthogHost = process.env.POSTHOG_HOST || 'https://eu.i.posthog.com';
client = new PostHog(posth
Medium
Ai Review Evidence
The CLI initializes telemetry before parsing commands and sends events to a default PostHog host unless telemetry is disabled.
dist/src/core/telemetry.jsView on unpkg · L62Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/src/index.js
MediumAi Review Evidencedist/src/core/telemetry.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.133.2.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.133.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.