registry / @doist/twist-cli / 3.0.12

@doist/twist-cli@3.0.12

TypeScript CLI for Twist

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Automatic lifecycle mutation of existing AI-agent skill files is a real extension lifecycle risk. It is limited to first-party Twist skill paths and no concrete exfiltration, remote execution, or broad control-surface rewrite was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm runs the package postinstall hook.

Impact

Existing Twist CLI skills under supported agent configuration directories can be overwritten during package installation.

Mechanism

The hook calls the installed-skill updater, which checks agent skill paths and writes package-provided SKILL.md content when a Twist skill already exists.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/postinstall.jsdist/lib/skills/update-installed.jsdist/lib/skills/index.jsdist/lib/skills/create-installer.js.claude/skills/twist-cli/SKILL.md.codex/skills/twist-cli/SKILL.md.cursor/skills/twist-cli/SKILL.md.gemini/skills/twist-cli/SKILL.md.pi/skills/twist-cli/SKILL.md.agents/skills/twist-cli/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an automatic postinstall lifecycle hook.
The lifecycle script imports the built postinstall module.
Postinstall updates every already installed Twist skill without user command invocation.
The updater targets configured Claude Code, Codex, Cursor, Gemini, Pi, and universal agent skill locations.
The installer overwrites the existing skill file with package-provided content.

Evidence against

No network endpoint or credential forwarding was identified in the inspected lifecycle and skill-installation paths.
The updater skips agent locations where the Twist skill is not already installed.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 392 KB of source, external domains: api.twist.com, github.com, raw.githubusercontent.com, twist.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-37json

2 "name": "@doist/twist-cli",

3 "version": "3.0.12",

4 "description": "TypeScript CLI for Twist",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "tw": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "lint": "oxlint . --fix && oxfmt",

16 "lint:check": "oxlint . && oxfmt --check",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "twist",

26 "cli",

27 "messaging",

28 "doist"

29 ],

30 "author": "Ernesto García <ernesto@ernesto.dev>",

31 "license": "MIT",

32 "engines": {

33 "node": ">=24",

34 "npm": ">=11"

35 },

36 "repository": {

37 "type": "git",

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/twist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

dist/lib/skills/create-installer.jsView file

Lines 4-44javascript

4import { CliError } from '../errors.js';

5import { SKILL_FILE_CONTENT, SKILL_NAME } from './content.js';

6export function createInstaller(config) {

7 function getInstallPath

dist/lib/input.jsView file

•matchType = normalized_sha256 matchedPackage = @doist/twist-cli@3.0.8 matchedPath = dist/lib/input.js matchedIdentity = npm:QGRvaXN0L3R3aXN0LWNsaQ:3.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/input.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = acd00388ab62c770 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @doist/twist-cli@3.0.8 matchedPath = dist/lib/input.js matchedIdentity = npm:QGRvaXN0L3R3aXN0LWNsaQ:3.0.8 similarity = 1.000 shingleOverlap = 22 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/lib/input.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/content.js')).href L18: const { SKILL_FILE_CONTENT } = await import(modulePath) L19: const expected = SKILL_FILE_CONTENT

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

Findings

1 Critical3 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/lib/input.js

HighKnown Malware Source Fingerprint Signaturedist/lib/input.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @doist/twist-cli@3.0.12.

See all versions of @doist/twist-cli for other recorded verdicts.

Review the evidence and your use of @doist/twist-cli@3.0.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 02:41:06.241Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @doist

Runtime surface

Behavioral surface

Related packages

More from @doist

Source & flagged code