@cliphijack/santaclaude@1.0.124
SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe default setup installs persistent Claude hooks across user sessions, including transcript processing and automatic project-instruction updates. This warrants a warning for agent configuration capability; the inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the santaclaude connect command and starts the connector.
Impact
Future Claude sessions run the installed hooks, and project instructions may be changed and committed automatically.
Mechanism
The connector registers package-provided hooks in the global Claude settings; the transcript-sync hook invokes the local Claude CLI and can append extracted rules to the project instructions.
AI rationale
The default setup installs persistent Claude hooks across user sessions, including transcript processing and automatic project-instruction updates. This warrants a warning for agent configuration capability; the inspected source does not establish malicious behavior.
Evidence
santaclaude.jshooks/mdsync-apply.js~/.claude/settings.json~/.claude/hooks<project>/CLAUDE.md
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the connector installs Stop, SessionStart, and other hooks into the user-wide Claude settings file by default.
- The SessionStart hook reads recent Claude transcripts, asks the local Claude CLI to extract persistent rules, and can append them to the project’s CLAUDE.md and commit that change.
- Hook installation is reached through the explicit connect command; this package has no npm lifecycle script.
Evidence against
- The manifest exposes a CLI entrypoint and contains no lifecycle scripts.
- The transcript-sync hook uses the local claude command and writes rules to the current project; the inspected source does not establish an unrelated network recipient or a concrete attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcebundled-superpowers/skills/brainstorming/scripts/server.cjsView file
536const url = companionUrl(); // must carry the key or the gate 403s it
L537: const cp = require('child_process');
L538: // Operator-provided launcher: run as given (this env var is trusted operator input).
High
Child Process
Package source references child process execution.
bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L536•matchType = normalized_sha256
matchedPackage = engine7@7.1.116
matchedPath = [redacted].cjs
matchedIdentity = npm:ZW5naW5lNw:7.1.116
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg1const crypto = require('crypto');
L2: const http = require('http');
L3: const fs = require('fs');
...
L12: function computeAcceptKey(clientKey) {
L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');
L14: }
...
L84:
L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null;
L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383);
...
L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {}
L196: location.replace('/');
L197: </script>
Findings
10 High4 Medium4 Low
HighChild Processbundled-superpowers/skills/brainstorming/scripts/server.cjs
HighShell
HighSame File Env Network Executionsantaclaude.js
HighCommand Output Exfiltrationsantaclaude.js
HighExternal Ai Agent Control Surface Mutationsantaclaude.js
HighTrigger Reachable External Ai Agent Control Surface Mutationsantaclaude.js
HighRuntime Package Installsantaclaude.js
HighSemantic Analysis Limitedbundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritybundled-superpowers/skills/brainstorming/scripts/server.cjs
HighKnown Malware Source Similaritybundled-superpowers/skills/writing-skills/render-graphs.js
Affected versions and remediation
This report applies to @cliphijack/santaclaude@1.0.124.
See all versions of @cliphijack/santaclaude for other recorded verdicts.
- Review the evidence and your use of @cliphijack/santaclaude@1.0.124 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.