@chem-x/starter-kit@26.9.11-631
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo lifecycle hook or covert install-time behavior was found. The CLI nevertheless provides an opaque remote payload writer, explicit AI-agent instruction setup, and optional VCS/CI mutation.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs create, init, or hook-related CLI commands.
Impact
A compromised service response can overwrite paths outside the selected directory or introduce project code and agent instructions; the hook command can affect commits and CI.
Mechanism
Remote file download with unchecked path writes and optional project automation setup.
AI rationale
No lifecycle hook or covert install-time behavior was found. The CLI nevertheless provides an opaque remote payload writer, explicit AI-agent instruction setup, and optional VCS/CI mutation.
Evidence
cli/scaffold.jscli/license.jscli/installer.jscli/index.js~/.chemical-x/device_id~/.chemical-x/config.json<targetDir>/<server-provided path><targetDir>/.cursorrules.git/hooks/pre-commit.github/workflows/chemx-audit.yml
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The create and init commands download server-provided files and write each supplied path under the selected directory without path validation.
- Scaffolding creates a Cursor instruction file that directs agents to follow AGENTS.md.
- The explicit hook setup command can install a pre-commit hook and GitHub Actions workflow.
- A supplied license key and generated device identifier are sent to the package service.
Evidence against
- package.json defines no preinstall, install, or postinstall hook.
- These actions are reached through named CLI commands, not during dependency installation.
- GitHub token use is confined to the user-selected audit-sharing feature.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcecli/navigator-share.jsView file
2import path from 'node:path';
L3: import { spawnSync } from 'node:child_process';
L4: import {
High
Child Process
Package source references child process execution.
cli/navigator-share.jsView on unpkg · L2cli/terminal.jsView file
9} else if (platform === "win32") {
L10: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });
L11: } else {
High
cli/license.jsView file
3import os from 'node:os';
L4: import { spawnSync } from 'node:child_process';
L5: import {
...
L16:
L17: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L18: export const URL_LEARN = 'https://chemicalx.xophz.com';
Findings
5 High2 Medium5 Low
HighChild Processcli/navigator-share.js
HighShellcli/terminal.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPrevious Version Dangerous Deltacli/license.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chem-x/starter-kit@26.9.11-631.
See all versions of @chem-x/starter-kit for other recorded verdicts.
- Review the evidence and your use of @chem-x/starter-kit@26.9.11-631 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.