registry / AI-agent capability abuse / @delorenj/pjangler / 1.3.0

@delorenj/pjangler@1.3.0

Project subsystem bootstrapper CLI

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No concrete malicious install-time chain was found. Warn because explicit use can persist AI-agent hooks that process prompts and code edits through an external CLI.

Static reason

No blocking static signals were detected.

Trigger

User runs pjangler add agent-hooks or an init workflow that includes it, then enters the generated project with mise.

Impact

Configured hooks can process user prompts and edited-content snippets under the user's agent sessions.

Mechanism

Project hook fan-out into AI-agent configuration, with Hindsight memory calls.

AI rationale

No concrete malicious install-time chain was found. Warn because explicit use can persist AI-agent hooks that process prompts and code edits through an external CLI.

Evidence

dist/index.jstemplates/commonproject/template/.agents/hooks/sync.pytemplates/commonproject/template/.agents/hooks/hindsight/hindsight-retain.shpackage.jsonmise.toml.agents/hooks.agents/skills.json.claude/settings.json~/.codex/hooks.json~/.kimi-code/config.toml

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit agent-hooks recipe installs a six-CLI hook topology.
Scaffolded sync script writes per-user Codex hooks.
Installed hooks pass edited-content snippets to the external hindsight CLI.

Evidence against

package.json has no preinstall, install, or postinstall hook; prepublishOnly is publisher-time.
Mutation requires an explicit pjangler add/init workflow and supports dry-run/opt-out.
Codex hook changes are marker-scoped, backed up, and removable.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 779 KB of source, external domains: dash.cloudflare.com, github.com, plane.delo.sh, raw.githubusercontent.com

Source & flagged code

5 flagged

.mise/scripts/versioning.shView file

•path = .mise/scripts/versioning.sh kind = payload_in_excluded_dir sizeBytes = 8295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.mise/scripts/versioning.shView on unpkg

•path = .mise/scripts/versioning.sh kind = build_helper sizeBytes = 8295 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.mise/scripts/versioning.shView on unpkg

dist/index.jsView file

Lines 5864-5904javascript

5864 };

5865 });

5866 return { message: formatRulePickerMessage(rules), options };

5867}

5868function formatRulePickerMessage(rules) {

5869 const counts = {};

5870 for (const rule of rules) counts[rule.status] = (counts[rule.status] ?? 0) + 1;

5871 const fragments = [];

5872 if (counts.fail) fragments.push(red(`${counts.fail} failing`));

5873 if (counts.warn) fragments.push(yellow(`${counts.warn} warning${counts.warn === 1 ? "" : "s"}`));

5874 if (counts.pass) fragments.push(green(`${counts.pass} passing`));

5875 if (counts.skip) fragments.push(gray(`${counts.skip} skipped`));

5876 fragments.push(dim("`pjangler audit` for full detail"));

5877 return `Select parity rules to apply ${joinDot(fragments)}`;

5878}

5879

5880// src/recipes/AgentHooksRecipe.ts

5881var AgentHooksRecipe = class extends Recipe {

5882 checks = createAgentHooksChecks();

5883 metadata = {

5884 id: "agent-hooks",

5885 name: "agent-hooks",

5886 description: "Project-scoped agent hooks and six-CLI skill topology",

5887 dependencies: ["mise"],

5888 commands: ["CopyAgentHooksTree", "WireMiseAgentHooks"],

5889 publicRuleIds: this.checks.map((check) => check.id)

Medium

Ai Review Evidence

Explicit agent-hooks recipe installs a six-CLI hook topology.

dist/index.jsView on unpkg · L5884

5890 };

5891 constructor(context) {

5892 super(context);

5893 }

5894 init(ctx, _input) {

5895 return this.initializeOwnedChecks(ctx);

5896 }

5897 printNextSteps() {

5898 console.log("\u{1FA9D} Agent-hooks layer installed!");

5899 console.log(" Next steps:");

5900 console.log(" 1. mise run skills:sync # sync .agents/skills.json into local CLI dirs");

5901 console.log(" 2. mise run hooks:sync # generate .claude/settings.json + inject codex/kimi/hermes");

5902 console.log(" 3. git add .claude/settings.json .agents/hooks .agents/skills.json && commit (codex/kimi/hermes are per-dev)");

5903 console.log(" 4. mise run hindsight:setup # set HINDSIGHT_OP_KEY_REF to your 1Password item first");

5904 console.log(" 5. Optional per-dev hook opt-out: copy .agents/local.example.json -> .agents/local.json");

•path = dist/index.js kind = trigger_reachable_excluded_payload sizeBytes = 417810 triggerReachableSource = dist/index.js excludedPayload = .mise/scripts/versioning.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/index.jsView on unpkg

templates/commonproject/template/.agents/hooks/sync.pyView file

Lines 204-244text

204 elif not group.get("hooks"):

205 new_groups.append(group) # preserve foreign empty groups untouched

206 if new_groups:

207 hooks_obj[event] = new_groups

208 else:

209 del hooks_obj[event]

210 changed = True

211 return changed

212

213

214def _codex_load(target: Path) -> dict:

215 if target.exists():

Source & flagged code

5 flagged · loading source

.mise/scripts/versioning.shView file

•path = .mise/scripts/versioning.sh kind = payload_in_excluded_dir sizeBytes = 8295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.mise/scripts/versioning.shView on unpkg

•path = .mise/scripts/versioning.sh kind = build_helper sizeBytes = 8295 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.mise/scripts/versioning.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = trigger_reachable_excluded_payload sizeBytes = 417810 triggerReachableSource = dist/index.js excludedPayload = .mise/scripts/versioning.sh

Critical

Trigger Reachable Excluded Directory Payload

Findings

1 Critical1 High5 Medium5 Low

CriticalTrigger Reachable Excluded Directory Payloaddist/index.js

HighPayload In Excluded Dir.mise/scripts/versioning.sh

MediumEnvironment Vars

MediumShips Build Helper.mise/scripts/versioning.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

MediumAi Review Evidencetemplates/commonproject/template/.agents/hooks/sync.py

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @delorenj/pjangler@1.3.0.

See all versions of @delorenj/pjangler for other recorded verdicts.

Review the evidence and your use of @delorenj/pjangler@1.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-15 17:23:58.202Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code