Loading npm security reports…

@darkrei08/wizard-ai-cli@0.52.50: AI-agent control-surface risk | LPM Firewall

registry / @darkrei08/wizard-ai-cli / 0.52.50

@darkrei08/wizard-ai-cli@0.52.50

Installer for the Wizard-AI environment: AI CLI tools and Claude Code skills (graphify, llmlingua, flashrank, markitdown and more). Clones the repo and runs the platform setup script.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The default CLI installer can automatically alter several AI-agent control surfaces and enable a persistent proxy. It inserts dummy credentials, routes provider traffic through local services, and provisions account tokens.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run the default CLI installer in a non-interactive environment or invoke its install flow.

Impact

AI-agent traffic/configuration can be redirected and persistent services enabled without a separate proxy-consent step.

Mechanism

Cross-agent config takeover plus persistent OAuth proxy setup.

Policy narrative

The launcher defaults to the installer; non-interactive execution selects all remote repositories. After that flow, wizard-installer invokes wz-ai-proxy.js auto-setup. That code installs a rotator, copies/provisions account data, overwrites Pi authentication and provider routing, and creates restart-on-boot services. Separate shipped tooling also writes global instructions for Pi, Claude, and Amp. These are broad foreign AI-agent control-surface mutations and are not limited to a package-owned extension.

Rationale

Source confirms a concrete, automatic chain from the package’s default installer flow to foreign agent-config rewrites, credential/proxy provisioning, and persistence. The lack of an npm lifecycle hook does not mitigate the unsafe default CLI behavior.

Evidence

package.jsonscripts/wizard-installer.jsscripts/wz-ai-proxy.jsscripts/wz-ai-cockpit.jsscripts/inject-global-prompts.sh~/.pi/agent/auth.json

Source & flagged code

5 flagged · loading source

index.jsView file

6L7: const path = require('path'); L8: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

scripts/wz-ai-proxy.jsView file

2L3: const { execSync } = require('child_process'); L4: const path = require('path'); ... L13: function getSystemdEnv() { L14: const uid = typeof os.userInfo === 'function' ? os.userInfo().uid : process.getuid(); L15: return { L16: ...process.env, L17: XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR || `/run/user/${uid}`, ... L47: model: openai/gemini-3.1-pro L48: api_base: http://127.0.0.1:51200/v1 L49: api_key: dummy ... L75: if (fs.existsSync(authFile)) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/wz-ai-proxy.jsView on unpkg · L2

scripts/wz-ai-cockpit.jsView file

256package = @darkrei08/wizard-ai-cli; repositoryIdentity = wizard-ai; dependency = @clack/prompts L256: try { L257: prompts = require('@clack/prompts'); L258: pc = require('picocolors');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/wz-ai-cockpit.jsView on unpkg · L256

scripts/install-mattpocock-skills.shView file

•path = scripts/install-mattpocock-skills.sh kind = build_helper sizeBytes = 2656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-mattpocock-skills.shView on unpkg

scripts/wz-ai-auto-updater.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @darkrei08/wizard-ai-cli@0.52.33 matchedIdentity = npm:[redacted]:0.52.33 similarity = 0.722 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/wz-ai-auto-updater.jsView on unpkg

Source & flagged code

5 flagged

index.jsView file

Lines 1-26javascript

1/**

2 * Wizard-AI Pi Extension

3 * Registers the Wizard-AI ecosystem as a pi-extensible-workflows extension,

4 * exposing reusable functions, variables, and workflow definitions.

5 */

6

7const path = require('path');

8const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

9

10module.exports = async function (api) {

11 // Register slash commands

12 api.registerCommand('wizard', {

13 description: 'Show Wizard-AI extension status and available workflows',

14 handler: (_args, ctx) => {

15 ctx.ui.notify('🪄 Wizard-AI Pi Extension loaded.\nAvailable workflows: loop-2-develop, shadow-clone-jutsu', 'info');

16 },

17 });

18

19 // Load Cockpit Tools Pi Extension

20 try {

21 const cockpitExtension = require(path.join(__dirname, 'packages', 'pi-cockpit-tools', 'index.js'));

22 cockpitExtension(api);

23 } catch (err) {

24 if (process.env.WZ_AI_DEBUG) console.error(err);

25 api.registerCommand('cockpit', {

26 description: 'Cockpit Tools extension (standalone mode, failed to load)',

scripts/wz-ai-proxy.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { execSync } = require('child_process');

4const path = require('path');

5const

scripts/wz-ai-cockpit.jsView file

Lines 236-276javascript

236}

237

238// ── Auto-Rotate ────────────────────────────────────────────────────────────

239

240function autoRotateAccount() {

241 const status = getAccountStatus();

242 if (

scripts/install-mattpocock-skills.shView file

•path = scripts/install-mattpocock-skills.sh kind = build_helper sizeBytes = 2656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-mattpocock-skills.shView on unpkg

scripts/wz-ai-auto-updater.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @darkrei08/wizard-ai-cli@0.52.33 matchedIdentity = npm:[redacted]:0.52.33 similarity = 0.722 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/wz-ai-auto-updater.jsView on unpkg