registry / @drdeeks/character-kit / 1.0.2

@drdeeks/character-kit@1.0.2

Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook enters an interactive installer; its persistence and agent-enforcement features are package-aligned and gated by selected setup options.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User responds to installer prompts or explicitly passes --yes/--all

Impact

Can create the chosen workspace/.agent files and run local background enforcement processes; no credential exfiltration or remote payload execution found

Mechanism

Local agent-enforcer workspace, socket daemon, and optional monitor/watchdog setup

Rationale

Direct inspection finds an interactive, local enforcement-tool installer rather than a covert malicious chain. The lifecycle hook is concerning but does not automatically mutate foreign AI-agent control surfaces, and no exfiltration, remote endpoint, or payload execution was found.

Evidence

package.jsonnode/bin/install.jsnode/src/index.jsnode/enforcer/agent_enforcer_daemon.jsnode/bin/ack.jsdeploy/ack_monitor.pydeploy/ack_watchdog.pydeploy/agent-enforcer.servicepython/tests/python_parity_test.py<workspace>/.agent/<workspace>/.env<package-root>/.env

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json invokes node/bin/install.js on install
node/bin/install.js can spawn detached daemon and monitor processes
deploy/ contains root systemd persistence tooling

Evidence against

Installer asks for setup choices before scaffolding or launching components
Root persistence requires explicit --all/--root path, not default lifecycle args
Companion generation only prints hook configuration; it does not write foreign harness config
Daemon exposes a local Unix/TCP socket and audit files, with no outbound HTTP client or endpoint
python/tests/python_parity_test.py is ordinary ASCII test code, not a hidden payload

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 139 KB of source, external domains: www.apple.com

Source & flagged code

16 flagged

package.jsonView file

Lines 1-34json

2 "name": "@drdeeks/character-kit",

3 "version": "1.0.2",

4 "description": "Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.",

5 "main": "node/src/index.js",

6 "bin": {

7 "ack": "node/bin/ack.js",

8 "character-kit": "node/bin/ack.js"

9 },

10 "type": "module",

11 "scripts": {

12 "test": "node --test node/tests/*.test.js",

13 "start": "node bin/aik.js",

14 "install": "node node/bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "ack-install": "node node/bin/install.js"

16 },

17 "keywords": [

18 "agent",

19 "character",

20 "agent-character",

21 "enforcement",

22 "knowledge",

23 "memory",

24 "semantic-search",

25 "hooks",

26 "yaml",

27 "frontmatter",

28 "claude",

29 "cursor",

30 "gemini",

31 "hermes",

32 "opencode"

33 ],

34 "author": "drdeeks",

python/agent_character_kit/enforcer.pyView file

Lines 228-268python

228 if self._leaks_secret(tool, command, step):

229 return (

230 f"Blocked by habit {habit.get('name')}: probable credential "

231 f"leak detected in tool call. A guard that fails open on "

232 f"secrets is no guard."

233 )

234 return None

235

236 def _leaks_secret(self, tool, command, step) -> bool:

237 """Fail-closed secret scan. Returns True if the call carries what looks

238 like a real credential value (not merely mentioning the word)."""

node/bin/install.jsView file

Lines 6-46javascript

6 * - the enforcement daemon (CORE, out-of-process)

7 * - the harness companion (thin client: hook config for any framework)

8 * - the acknowledgment monitor (credits the daemon from the ack log)

9 * - the monitor watchdog (revives the monitor)

node/bin/aik.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3import { Command } from "commander";

4import { processToolCall, generateConfig, EnforcerClient } from "../src/index.js";

5import fs from "fs";

6import os from "os";

7import path from

node/enforcer/agent_enforcer_daemon.jsView file

Lines 3-43javascript

3 * Agent Character Kit Enforcer Daemon

4 *

5 * Root-owned, system-level enforcement service for ACK.

6 * Runs as daemon under systemd with automatic restart (RestartSec=3

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

python/example_workspace/.agent/habits/no-credential-leak.yamlView file

Lines 1-38yaml

1# Hard gate: credential leak detection. level: hard => BLOCKS the action.

3# Correct action: DENY any tool call that would emit a real secret.

4# Evidence: a known secret prefix OR an assignment of a secret-shaped value to a

5# public surface (command line, file write, stdout, web call).

6# Logic: a leaked credential is irreversible — you cannot un-publish it. The only

7# safe secret is one that never entered the call. Fail CLOSED: if we can't

8# be sure it's safe, we block. A guard that fails open on secrets is no guard.

10name: "no_credential_leak"

node/examples/.agent/habits/no-credential-leak.yamlView file

18patternName = private_key_rsa severity = critical line = 18 matchedText = - "Comma...-)."

Critical

Secret Pattern

RSA private key in node/examples/.agent/habits/no-credential-leak.yaml

node/examples/.agent/habits/no-credential-leak.yamlView on unpkg · L18

34patternName = private_key_rsa severity = critical line = 34 matchedText = - "-----...---"

Critical

Secret Pattern

RSA private key in node/examples/.agent/habits/no-credential-leak.yaml

node/examples/.agent/habits/no-credential-leak.yamlView on unpkg · L34

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.install = node node/bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node node/bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

python/agent_character_kit/enforcer.pyView file

248patternName = private_key_rsa severity = critical line = 248 matchedText = "ghp_", ...-"):

Critical

Critical Secret

Package contains a critical-looking secret pattern.

python/agent_character_kit/enforcer.pyView on unpkg · L248

248patternName = private_key_rsa severity = critical line = 248 matchedText = "ghp_", ...-"):

Critical

Secret Pattern

RSA private key in python/agent_character_kit/enforcer.py

python/agent_character_kit/enforcer.pyView on unpkg · L248

node/bin/install.jsView file

26import readline from "readline"; L27: import { spawn } from "child_process"; L28: import { fileURLToPath, pathToFileURL } from "url";

High

Child Process

Package source references child process execution.

node/bin/install.jsView on unpkg · L26

node/bin/aik.jsView file

14const getMemory = async () => (await import("../src/memory/index.js")).Memory; L15: import { spawn } from "child_process"; L16: import { fileURLToPath } from "url"; ... L50: L51: const payload = input ? JSON.parse(input) : {}; L52: const result = await processToolCall(payload, { framework: opts.framework }); L53: console.log(JSON.stringify(result.output)); L54: process.exit(result.exitCode); L55: }); ... L116: child = spawn(process.execPath, [daemonScript], { L117: env: process.env, L118: stdio: "inherit",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

node/bin/aik.jsView on unpkg · L14

node/enforcer/agent_enforcer_daemon.jsView file

23const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/); L24: if (m && !(m[1] in process.env)) process.env[m[1]] = m[2]; L25: } ... L27: L28: import net from "net"; L29: import fs from "fs"; ... L31: import path from "path"; L32: import { execSync } from "child_process"; L33: import yaml from "js-yaml";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/enforcer/agent_enforcer_daemon.jsView on unpkg · L23

110patternName = private_key_rsa severity = critical line = 110 matchedText = "Command...).",

Critical

Secret Pattern

RSA private key in node/enforcer/agent_enforcer_daemon.js

node/enforcer/agent_enforcer_daemon.jsView on unpkg · L110

118patternName = private_key_rsa severity = critical line = 118 matchedText = "ghp_", ...--",

Critical

Secret Pattern

RSA private key in node/enforcer/agent_enforcer_daemon.js

node/enforcer/agent_enforcer_daemon.jsView on unpkg · L118

295patternName = private_key_rsa severity = critical line = 295 matchedText = "glpat-"...)) {

Critical

Secret Pattern

RSA private key in node/enforcer/agent_enforcer_daemon.js

node/enforcer/agent_enforcer_daemon.jsView on unpkg · L295

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

python/example_workspace/.agent/habits/no-credential-leak.yamlView file

18patternName = private_key_rsa severity = critical line = 18 matchedText = - "Comma...-)."

Critical

Secret Pattern

RSA private key in python/example_workspace/.agent/habits/no-credential-leak.yaml

python/example_workspace/.agent/habits/no-credential-leak.yamlView on unpkg · L18

34patternName = private_key_rsa severity = critical line = 34 matchedText = - "-----...---"

Critical

Secret Pattern

RSA private key in python/example_workspace/.agent/habits/no-credential-leak.yaml

python/example_workspace/.agent/habits/no-credential-leak.yamlView on unpkg · L34

node/examples/.agent/habits/no-credential-leak.yamlView file

18patternName = private_key_rsa severity = critical line = 18 matchedText = - "Comma...-)."

Critical

Secret Pattern

RSA private key in node/examples/.agent/habits/no-credential-leak.yaml

node/examples/.agent/habits/no-credential-leak.yamlView on unpkg · L18

34patternName = private_key_rsa severity = critical line = 34 matchedText = - "-----...---"

Critical

Secret Pattern

RSA private key in node/examples/.agent/habits/no-credential-leak.yaml

node/examples/.agent/habits/no-credential-leak.yamlView on unpkg · L34

Findings

10 Critical4 High5 Medium4 Low

CriticalCritical Secretpython/agent_character_kit/enforcer.py

CriticalSame File Env Network Executionnode/enforcer/agent_enforcer_daemon.js

CriticalSecret Patternpython/agent_character_kit/enforcer.py

CriticalSecret Patternpython/example_workspace/.agent/habits/no-credential-leak.yaml

CriticalSecret Patternnode/enforcer/agent_enforcer_daemon.js

CriticalSecret Patternnode/examples/.agent/habits/no-credential-leak.yaml

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processnode/bin/install.js

HighShell

HighPayload In Excluded Dirpython/tests/python_parity_test.py

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumInstall Persistencenode/bin/aik.js

MediumShips Build Helperpython/tests/python_parity_test.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

16 flagged

package.jsonView file

Lines 1-34json

2 "name": "@drdeeks/character-kit",

3 "version": "1.0.2",

4 "description": "Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.",

5 "main": "node/src/index.js",

6 "bin": {

7 "ack": "node/bin/ack.js",

8 "character-kit": "node/bin/ack.js"

9 },

10 "type": "module",

11 "scripts": {

12 "test": "node --test node/tests/*.test.js",

13 "start": "node bin/aik.js",

14 "install": "node node/bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "ack-install": "node node/bin/install.js"

16 },

17 "keywords": [

18 "agent",

19 "character",

20 "agent-character",

21 "enforcement",

22 "knowledge",

23 "memory",

24 "semantic-search",

25 "hooks",

26 "yaml",

27 "frontmatter",

28 "claude",

29 "cursor",

30 "gemini",

31 "hermes",

32 "opencode"

33 ],

34 "author": "drdeeks",

python/agent_character_kit/enforcer.pyView file

Lines 228-268python

228 if self._leaks_secret(tool, command, step):

229 return (

230 f"Blocked by habit {habit.get('name')}: probable credential "

231 f"leak detected in tool call. A guard that fails open on "

232 f"secrets is no guard."

233 )

234 return None

235

236 def _leaks_secret(self, tool, command, step) -> bool:

237 """Fail-closed secret scan. Returns True if the call carries what looks

238 like a real credential value (not merely mentioning the word)."""

node/bin/install.jsView file

Lines 6-46javascript

6 * - the enforcement daemon (CORE, out-of-process)

7 * - the harness companion (thin client: hook config for any framework)

8 * - the acknowledgment monitor (credits the daemon from the ack log)

9 * - the monitor watchdog (revives the monitor)

node/bin/aik.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3import { Command } from "commander";

4import { processToolCall, generateConfig, EnforcerClient } from "../src/index.js";

5import fs from "fs";

6import os from "os";

7import path from

node/enforcer/agent_enforcer_daemon.jsView file

Lines 3-43javascript

3 * Agent Character Kit Enforcer Daemon

4 *

5 * Root-owned, system-level enforcement service for ACK.

6 * Runs as daemon under systemd with automatic restart (RestartSec=3

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

python/example_workspace/.agent/habits/no-credential-leak.yamlView file

Lines 1-38yaml

1# Hard gate: credential leak detection. level: hard => BLOCKS the action.

3# Correct action: DENY any tool call that would emit a real secret.

4# Evidence: a known secret prefix OR an assignment of a secret-shaped value to a

5# public surface (command line, file write, stdout, web call).

6# Logic: a leaked credential is irreversible — you cannot un-publish it. The only

7# safe secret is one that never entered the call. Fail CLOSED: if we can't

8# be sure it's safe, we block. A guard that fails open on secrets is no guard.

10name: "no_credential_leak"

node/examples/.agent/habits/no-credential-leak.yamlView file

18patternName = private_key_rsa severity = critical line = 18 matchedText = - "Comma...-)."

Critical

Secret Pattern

RSA private key in node/examples/.agent/habits/no-credential-leak.yaml

node/examples/.agent/habits/no-credential-leak.yamlView on unpkg · L18

34patternName = private_key_rsa severity = critical line = 34 matchedText = - "-----...---"

Critical

Secret Pattern

RSA private key in node/examples/.agent/habits/no-credential-leak.yaml

node/examples/.agent/habits/no-credential-leak.yamlView on unpkg · L34