registry / @doist/twist-cli / 3.0.13

@doist/twist-cli@3.0.13

TypeScript CLI for Twist

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Automatic mutation of pre-existing AI-agent skill files is a guarded first-party extension lifecycle risk. The inspected code does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm post-install execution.

Impact

Existing first-party Twist CLI agent skills may change automatically during package installation.

Mechanism

The post-install module enumerates configured skill installers, detects existing skill files, and overwrites those package-owned files.

AI rationale

Automatic mutation of pre-existing AI-agent skill files is a guarded first-party extension lifecycle risk. The inspected code does not establish a concrete malicious attack.

Evidence

~/.claude/skills/twist-cli/SKILL.md~/.codex/skills/twist-cli/SKILL.md~/.cursor/skills/twist-cli/SKILL.md~/.gemini/skills/twist-cli/SKILL.md~/.pi/skills/twist-cli/SKILL.md~/.agents/skills/twist-cli/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package declares an automatic post-install script.
The post-install path updates every detected installed skill in the user scope.
Skill installation resolves agent skill paths from the home directory and writes the package-owned skill content.
The only child process found opens the user-selected editor for interactive input.

Evidence against

The skill updater skips agents whose Twist CLI skill is absent.
No arbitrary shell execution, evaluator, or unrelated network destination was found in the inspected paths.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 392 KB of source, external domains: api.twist.com, github.com, raw.githubusercontent.com, twist.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-37json

2 "name": "@doist/twist-cli",

3 "version": "3.0.13",

4 "description": "TypeScript CLI for Twist",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "tw": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "lint": "oxlint . --fix && oxfmt",

16 "lint:check": "oxlint . && oxfmt --check",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "twist",

26 "cli",

27 "messaging",

28 "doist"

29 ],

30 "author": "Ernesto García <ernesto@ernesto.dev>",

31 "license": "MIT",

32 "engines": {

33 "node": ">=24",

34 "npm": ">=11"

35 },

36 "repository": {

37 "type": "git",

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/twist-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

dist/lib/skills/create-installer.jsView file

Lines 4-44javascript

4import { CliError } from '../errors.js';

5import { SKILL_FILE_CONTENT, SKILL_NAME } from './content.js';

6export function createInstaller(config) {

7 function getInstallPath

dist/lib/input.jsView file

•matchType = normalized_sha256 matchedPackage = @doist/twist-cli@3.0.8 matchedPath = dist/lib/input.js matchedIdentity = npm:QGRvaXN0L3R3aXN0LWNsaQ:3.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/input.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = acd00388ab62c770 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @doist/twist-cli@3.0.8 matchedPath = dist/lib/input.js matchedIdentity = npm:QGRvaXN0L3R3aXN0LWNsaQ:3.0.8 similarity = 1.000 shingleOverlap = 22 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/lib/input.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/content.js')).href L18: const { SKILL_FILE_CONTENT } = await import(modulePath) L19: const expected = SKILL_FILE_CONTENT

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

Findings

1 Critical3 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/lib/skills/create-installer.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/lib/input.js

HighKnown Malware Source Fingerprint Signaturedist/lib/input.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @doist/twist-cli@3.0.13.

See all versions of @doist/twist-cli for other recorded verdicts.

Review the evidence and your use of @doist/twist-cli@3.0.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 04:34:15.678Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @doist

Runtime surface

Behavioral surface

Related packages

More from @doist

Source & flagged code