@cliphijack/santaclaude@1.0.123
SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package has no install lifecycle hook, but running its CLI installs agent hooks by default. Because those hooks can change project instructions based on session transcripts, warn about the agent configuration capability without treating it as an unconsented install-time attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI, then starts a Claude Code session in a project while the connector hook is active.
Impact
Generated project instructions can affect later Claude sessions in that project. The setup is user-command-initiated and has opt-out configuration, so this supports a warning rather than a publish block.
Mechanism
The CLI adds a session-start command to the user’s Claude settings. That command reads the session transcript and invokes Claude to extract persistent rules, which may be appended to the project instructions file.
AI rationale
The package has no install lifecycle hook, but running its CLI installs agent hooks by default. Because those hooks can change project instructions based on session transcripts, warn about the agent configuration capability without treating it as an unconsented install-time attack.
Evidence
santaclaude.jshooks/sc-mdsync.shhooks/mdsync-apply.js~/.claude/settings.json~/.claude/projectsproject/CLAUDE.md
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and defines no install lifecycle hook.
- Running the CLI installs global Claude hooks by default, with configuration flags to disable them.
- The session-start hook reads the project path and transcript path, then launches transcript processing in the background.
- The processor reads recent conversation text, asks Claude to extract persistent rules, and can append those rules to the project’s CLAUDE.md.
- The indicated skill-discovery code scans global and project skill directories; it does not itself modify agent configuration.
Evidence against
- The agent configuration changes require running the CLI; package installation alone does not trigger them.
- The brainstorming server starts only when run directly, and the graph renderer reads a skill file and writes rendered diagrams.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
11 flagged · loading sourcebundled-superpowers/skills/brainstorming/scripts/server.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cliphijack/santaclaude@1.0.121
matchedIdentity = npm:QGNsaXBoaWphY2svc2FudGFjbGF1ZGU:1.0.121
similarity = 0.889
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg536const url = companionUrl(); // must carry the key or the gate 403s it
L537: const cp = require('child_process');
L538: // Operator-provided launcher: run as given (this env var is trusted operator input).
High
Child Process
Package source references child process execution.
bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L5361const crypto = require('crypto');
L2: const http = require('http');
L3: const fs = require('fs');
...
L12: function computeAcceptKey(clientKey) {
L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');
L14: }
...
L84:
L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null;
L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383);
...
L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {}
L196: location.replace('/');
L197: </script>
Findings
1 Critical9 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltabundled-superpowers/skills/brainstorming/scripts/server.cjs
HighChild Processbundled-superpowers/skills/brainstorming/scripts/server.cjs
HighShell
HighSame File Env Network Executionsantaclaude.js
HighCommand Output Exfiltrationsantaclaude.js
HighExternal Ai Agent Control Surface Mutationsantaclaude.js
HighTrigger Reachable External Ai Agent Control Surface Mutationsantaclaude.js
HighRuntime Package Installsantaclaude.js
HighSemantic Analysis Limitedbundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritybundled-superpowers/skills/writing-skills/render-graphs.js
Affected versions and remediation
This report applies to @cliphijack/santaclaude@1.0.123.
See all versions of @cliphijack/santaclaude for other recorded verdicts.
- Review the evidence and your use of @cliphijack/santaclaude@1.0.123 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.