wgc@0.133.4
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package documents runtime telemetry and provides opt-outs, but its default payload includes raw command arguments, account-linked identifiers, and full failure details sent to PostHog. This exceeds ordinary anonymous usage metrics and merits a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI startup and command execution; command failures also trigger error telemetry. Users can opt out through documented environment variables.
Impact
Command arguments, which may contain identifying or sensitive values, and error details that may contain local paths or other context can be disclosed to the analytics service.
Mechanism
The CLI captures command options and arguments, associates events with the authenticated user email or organization ID, and sends them to PostHog. Failure events include error messages and stack traces.
AI rationale
The package documents runtime telemetry and provides opt-outs, but its default payload includes raw command arguments, account-linked identifiers, and full failure details sent to PostHog. This exceeds ordinary anonymous usage metrics and merits a warning.
Evidence
dist/src/index.jsdist/src/commands/index.jsdist/src/core/telemetry.jsREADME.md
Network endpoints1
eu.i.posthog.com (overridden by POSTHOG_HOST when set)
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI startup enables telemetry by default; each command sends its options and arguments to the telemetry capture function.
- Telemetry uses the authenticated account email as the PostHog distinct ID when available, otherwise the organization ID.
- Command failures send the error message and stack trace as telemetry properties.
- Telemetry metadata includes a SHA-256 hash of the machine hostname.
Evidence against
- The README discloses usage telemetry and provides COSMO_TELEMETRY_DISABLED and DO_NOT_TRACK opt-outs.
- The flagged Cursor rule file is generated only by the explicit plugin-init command inside the generated plugin directory.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/src/index.js
MediumAi Review Evidencedist/src/commands/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.133.4.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.133.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.