registry / AI-agent control-surface risk / @darkrei08/wizard-ai-cli
@darkrei08/wizard-ai-cli
Installer for the Wizard-AI environment: AI CLI tools and Claude Code skills (graphify, llmlingua, flashrank, markitdown and more). Clones the repo and runs the platform setup script.
This report shows the evidence for @darkrei08/wizard-ai-cli@0.52.50. 1 of 19 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource confirms a concrete, automatic chain from the package’s default installer flow to foreign agent-config rewrites, credential/proxy provisioning, and persistence. The lack of an npm lifecycle hook does not mitigate the unsafe default CLI behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the default CLI installer in a non-interactive environment or invoke its install flow.
Impact
AI-agent traffic/configuration can be redirected and persistent services enabled without a separate proxy-consent step.
Mechanism
Cross-agent config takeover plus persistent OAuth proxy setup.
Policy narrative
The launcher defaults to the installer; non-interactive execution selects all remote repositories. After that flow, wizard-installer invokes wz-ai-proxy.js auto-setup. That code installs a rotator, copies/provisions account data, overwrites Pi authentication and provider routing, and creates restart-on-boot services. Separate shipped tooling also writes global instructions for Pi, Claude, and Amp. These are broad foreign AI-agent control-surface mutations and are not limited to a package-owned extension.
AI rationale
Source confirms a concrete, automatic chain from the package’s default installer flow to foreign agent-config rewrites, credential/proxy provisioning, and persistence. The lack of an npm lifecycle hook does not mitigate the unsafe default CLI behavior.
Evidence
package.jsonscripts/wizard-installer.jsscripts/wz-ai-proxy.jsscripts/wz-ai-cockpit.jsscripts/inject-global-prompts.sh~/.pi/agent/auth.json~/.pi/agent/models.json~/.pi/agent/settings.json~/.config/systemd/user/wz-ai-proxy.service~/Library/LaunchAgents/com.wizardai.proxy.plist%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/wz-ai-proxy.vbs
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- scripts/wizard-installer.js auto-runs proxy auto-setup after installs.
- scripts/wz-ai-proxy.js overwrites ~/.pi/agent auth.json and models.json.
- Proxy redirects Pi providers to local rotator endpoints and provisions OAuth accounts.
- Proxy installs boot-persistent systemd, LaunchAgent, or Windows Startup services.
- scripts/inject-global-prompts.sh writes global Pi, Claude, and Amp instructions.
- Default non-TTY installer installs all registry repos, then performs proxy setup.
Evidence against
- package.json has no npm lifecycle hook.
- Network cloning and setup are reached through CLI execution, not package installation.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
5 flagged · loading sourceindex.jsView file
6L7: const path = require('path');
L8: const fs = require('fs');
Medium
scripts/wz-ai-proxy.jsView file
2L3: const { execSync } = require('child_process');
L4: const path = require('path');
...
L13: function getSystemdEnv() {
L14: const uid = typeof os.userInfo === 'function' ? os.userInfo().uid : process.getuid();
L15: return {
L16: ...process.env,
L17: XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR || `/run/user/${uid}`,
...
L47: model: openai/gemini-3.1-pro
L48: api_base: http://127.0.0.1:51200/v1
L49: api_key: dummy
...
L75: if (fs.existsSync(authFile)) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
scripts/wz-ai-proxy.jsView on unpkg · L2scripts/wz-ai-cockpit.jsView file
Findings
2 High6 Medium5 Low
HighCopied Package Dependency Bridgescripts/wz-ai-cockpit.js
HighPrevious Version Dangerous Deltascripts/wz-ai-auto-updater.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencescripts/wz-ai-proxy.js
MediumShips Build Helperscripts/install-mattpocock-skills.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @darkrei08/wizard-ai-cli@0.52.50.
The versions list below shows the verdict for each recorded version.
- Avoid installing @darkrei08/wizard-ai-cli@0.52.50. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.