wgc@0.133.5
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends default-on runtime telemetry to PostHog that includes command arguments and options, and failure messages and stacks that may contain identifying details. This meets the warning threshold for undisclosed telemetry; the flagged plugin setup itself is user-triggered scaffolding.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI startup initializes telemetry; command execution and failures trigger events.
Impact
Command arguments, options, and error details may contain identifying information, including local paths.
Mechanism
The CLI captures command arguments and options, failure messages and stacks, and a hashed hostname, then sends events to PostHog.
AI rationale
The CLI sends default-on runtime telemetry to PostHog that includes command arguments and options, and failure messages and stacks that may contain identifying details. This meets the warning threshold for undisclosed telemetry; the flagged plugin setup itself is user-triggered scaffolding.
Evidence
dist/src/index.jsdist/src/commands/index.jsdist/src/core/telemetry.jsdist/src/commands/router/commands/plugin/commands/init.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI initializes telemetry by default when its entry point runs, unless COSMO_TELEMETRY_DISABLED=true or DO_NOT_TRACK=1.
- The pre-action hook sends command arguments and options with each command-usage event.
- Failure telemetry includes the error message and stack, which can expose identifying details such as local paths.
- Telemetry uses PostHog at https://eu.i.posthog.com by default and includes a SHA-256 hash of the hostname.
Evidence against
- The flagged plugin initializer is an explicit scaffolding command; its file writes generate a plugin project and Cursor rules in that project.
- Telemetry can be disabled with COSMO_TELEMETRY_DISABLED=true or DO_NOT_TRACK=1.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/src/index.js
MediumAi Review Evidencedist/src/commands/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.133.5.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.133.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.