wgc@0.133.3
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe source confirms a user-triggered write of first-party Cursor agent configuration during plugin scaffolding, which retains a limited agent configuration risk. No automatic install-time mutation or broader control surface change was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the router plugin initialization command.
Impact
The generated Cursor rule can guide agent behavior in the scaffolded project when its file scope applies.
Mechanism
The command creates a .cursor/rules directory and writes a plugin development guide.
AI rationale
The source confirms a user-triggered write of first-party Cursor agent configuration during plugin scaffolding, which retains a limited agent configuration risk. No automatic install-time mutation or broader control surface change was identified.
Evidence
dist/src/commands/router/commands/plugin/commands/init.jsdist/src/commands/router/commands/plugin/templates/go.js.cursor/rules/plugin-development.mdc
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes router plugin initialization as a user-invoked command.
- Initialization creates a Cursor rules directory and writes a plugin development rule.
- The generated rule applies to src/** and sets alwaysApply to false.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The rule is part of plugin scaffolding and is not always applied.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/src/commands/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.133.3.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.133.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.