registry / @drdeeks/character-kit / 1.6.0

@drdeeks/character-kit@1.6.0

Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm uninstall from a node_modules installation.

Impact

May alter ~/.claude/settings.json and stop matching package services during removal.

Mechanism

Uninstall cleanup of package processes and Claude hook entries.

Rationale

Source inspection found no concrete malware chain, network exfiltration, or unconsented install-time agent-control mutation. Per policy, the uninstall-only Claude configuration mutation warrants a warning.

Evidence

package.jsonnode/bin/postinstall.jsnode/bin/preuninstall.jsnode/bin/install.jsdeploy/ack_watchdog.jsnode/enforcer/agent_enforcer_daemon.js~/.claude/settings.json/tmp/ack-preuninstall.log

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Global preuninstall lifecycle runs on package removal.
It terminates matching package daemon, monitor, and watchdog processes.
It rewrites Claude settings to remove ack.js-marked hooks.

Evidence against

Postinstall only logs setup guidance and states it performs no configuration.
Claude hook wiring is performed by explicit `ack configure` and can be declined.
No exfiltration, remote payload loading, or covert install-time configuration was found in inspected sources.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 401 KB of source

Source & flagged code

10 flagged

package.jsonView file

Lines 1-35json

2 "name": "@drdeeks/character-kit",

3 "version": "1.6.0",

4 "description": "Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.",

5 "main": "node/src/index.js",

6 "bin": {

7 "ack": "node/bin/ack.js",

8 "character-kit": "node/bin/ack.js"

9 },

10 "type": "module",

11 "scripts": {

12 "test": "node --test node/tests/*.test.js",

13 "start": "node node/bin/ack.js",

14 "ack-install": "node node/bin/install.js",

15 "postinstall": "node node/bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "preuninstall": "node node/bin/preuninstall.js"

17 },

18 "keywords": [

19 "agent",

20 "character",

21 "agent-character",

22 "enforcement",

23 "knowledge",

24 "memory",

25 "semantic-search",

26 "hooks",

27 "yaml",

28 "frontmatter",

29 "claude",

30 "cursor",

31 "gemini",

32 "hermes",

33 "opencode"

34 ],

35 "author": "drdeeks",

deploy/ack_watchdog.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2/**

3 * ACK monitor watchdog (self-healing companion, Node-native).

4 *

5 * Node port of ack_watchdog.py. Revives the acknowledgment monitor

6 * (ack_monitor.js) if it dies, and revives the enforcer daemon itself in

7 * root-mode installs. This is the self-healing layer: no single process in

8 * the daemon/monitor/watchdog trio is a point of failure on its own.

9 *

10 * Revival order: prefer `systemctl restart <unit>` (idempotent, re-reads the

11 * unit). Fall back to a direct launch if systemctl is unavailable (e.g. a

12 * container without systemd).

13 */

15import fs from "fs";

16import path from "path";

17import os from "os";

18import { fileURLToPath } from "url";

19import { spawn, spawnSync } from "child_process";

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

21const __dirname = path.dirname(fileURLToPath(import.meta.url));

23const PIDFILE = process.env.ACK_MONITOR_PID || "/var/lib/agent-character-kit/ack-monitor.pid";

24const WATCHDOG_PID = process.env.ACK_WATCHDOG_PID || "/var/lib/agent-character-kit/ack-watchdog.pid";

25const MONITOR_BIN = process.env.ACK_MONITOR_BIN || path.join(__dirname, "ack_monitor.js");

26const MONITOR_UNIT = "agent-character-monitor.service";

27const ENFORCER_UNIT = "agent-enforcer.service";

28const INTERVAL = parseInt(process.env.ACK_WATCHDOG_INTERVAL || "5", 10) * 1000;

30function log(msg) {

31 console.log(`${new Date().toISOString()} [ack-watchdog] ${msg}`);

32}

33function logError(msg) {

34 console.error(`${new Date().toISOString()} [ack-watchdog] ${msg}`);

35}

37function processAlive(pattern, pidfile) {

38 try {

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = deploy/ack_watchdog.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

deploy/ack_watchdog.jsView on unpkg

node/bin/install.jsView file

Lines 45-85javascript

45// stays available only for a Python-based deployment; it is never required

46// just to get the self-healing trio running, only for the Hermes companion.

47const MONITOR = path.join(REPO, "deploy", "ack_monitor.js");

48const WATCHDOG = path.join(REPO, "deploy", "ack_watchdog.js");

49const ACK_BIN = path.join(REPO, "node", "bin", "ack.js");

51// ─── arg parsing (non-interactive) ────────────────────────────────────────────

52function parseArgs(argv) {

53 const out = { workspace: null, socket: null, harness: null, root: null, serviceUser: null, yes: false, monitor: true, watchdog: true, companion: true, createHabit: false, habitName: null, habitPrompt: null, habitLogic: null, habitEvidence: null, habitLevel: null, all: false, hookCommand: null, python: null, vectors: false, start: true, writeClaudeConfig: true };

54 for (let i = 0; i < argv.length; i++) {

55 const a = argv[i];

56 if (a === "--workspace") out.workspace = argv[++i];

57 else if (a === "--socket") out.socket = argv[++i];

58 else if (a === "--harness") out.harness = argv[++i];

59 else if (a === "--root") out.root = true;

60 else if (a === "--user") out.root = false;

61 else if (a === "--service-user") { out.root = true; out.serviceUser = argv[++i]; }

62 else if (a === "--no-monitor") out.monitor = false;

63 else if (a === "--no-watchdog") out.watchdog = false;

64 else if (a === "--no-companion") out.companion = false;

65 else if (a === "--create-habit") out.createHabit = true;

66 else if (a === "--habit-name") out.habitName = argv[++i];

67 else if (a === "--habit-prompt") out.habitPrompt = argv[++i];

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

node/bin/install.jsView on unpkg · L65

68 else if (a === "--habit-logic") out.habitLogic = argv[++i];

69 else if (a === "--habit-evidence") out.habitEvidence = argv[++i];

70 else if (a === "--habit-level") out.habitLevel = argv[++i];

71 else if (a === "--yes" || a === "-y") out.yes = true;

72 else if (a === "--all") out.all = true;

73 else if (a === "--hook-command") out.hookCommand = argv[++i];

74 else if (a === "--python") out.python = true;

75 else if (a === "--no-python") out.python = false;

76 else if (a === "--vectors") out.vectors = true;

77 else if (a === "--no-vectors") out.vectors = false;

78 else if (a === "--start") out.start = true;

79 else if (a === "--no-start") out.start = false;

80 else if (a === "--claude-config") out.writeClaudeConfig = true;

81 else if (a === "--no-claude-config") out.writeClaudeConfig = false;

82 }

83 return out;

84}

Lines 244-284javascript

244 for (const f of fs.readdirSync(src)) {

245 if (f.endsWith(".yaml") && !fs.existsSync(path.join(dst, f))) {

246 fs.copyFileSync(path.join(src, f), path.join(dst, f));

247 }

248 }

249 }

250}

251

252function writeConstitution(ws) {

253 const dst = path.join(ws, ".agent", "constitution.yaml");

254 if (!fs.existsSync(dst)) {

255 fs.writeFileSync(dst, [

256 "# Agent Character Kit — constitution (hard constraints).",

257 "# The daemon embeds safe defaults; this file OVERRIDES/extends them.",

258 "hard_constraints:",

259 " - no_credential_leak: block any tool call that would expose a secret",

260 " - no_destructive_without_confirm: block rm -rf /, mkfs, dd on disks, etc. unless confirmed",

261 ].join("\n") + "\n");

262 }

263}

264

265// MOD-007: `spawn()` not throwing means the OS accepted the fork request,

266// not that the process is still running or responding to RPC a moment

267// later. A minimal, self-contained status ping -- deliberately not routed

268// through EnforcerClient (client.js), since that reads its token from

269// process.env.ACK_AUTH_TOKEN globally, and mutating the installer's own

270// process-wide env for a single liveness check is worse than a small

271// self-contained call, matching the same self-containment reasoning

272// ack_monitor.js's own header comment gives for not importing the repo's

273// shared client.

274export function pingDaemonStatus(sock, token) {

275 return new Promise((resolve) => {

276 if (!fs.existsSync(sock)) { resolve({ error: "socket not found" }); return; }

277 const socket = net.createConnection(sock);

278 let data = "";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/bin/install.jsView on unpkg · L264

279 const timeout = setTimeout(() => { socket.destroy(); resolve({ error: "timeout" }); }, 4000);

280 socket.on("connect", () => {

281 socket.write(JSON.stringify({ method: "status", params: {}, token }) + "\n");

282 });

283 socket.on("data", (chunk) => {

284 data += chunk.toString();

•Trigger-reachable chain: scripts.postinstall -> node/bin/postinstall.js -> node/bin/install.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

node/bin/install.jsView on unpkg

python/tests/ack_monitor_multi_agent_test.pyView file

•path = python/tests/ack_monitor_multi_agent_test.py kind = payload_in_excluded_dir sizeBytes = 5026 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

•path = python/tests/ack_monitor_multi_agent_test.py kind = build_helper sizeBytes = 5026 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

node/bin/ack.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @drdeeks/character-kit@1.5.0 matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.5.0 similarity = 0.871 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

deploy/ack_watchdog.jsView file

18import { fileURLToPath } from "url"; L19: import { spawn, spawnSync } from "child_process"; L20:

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

deploy/ack_watchdog.jsView on unpkg

node/bin/install.jsView file

264L265: // MOD-007: `spawn()` not throwing means the OS accepted the fork request, L266: // not that the process is still running or responding to RPC a moment ... L268: // through EnforcerClient (client.js), since that reads its token from L269: // process.env.ACK_AUTH_TOKEN globally, and mutating the installer's own L270: // process-wide env for a single liveness check is worse than a small ... L276: if (!fs.existsSync(sock)) { resolve({ error: "socket not found" }); return; } L277: const socket = net.createConnection(sock); L278: let data = "";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/bin/install.jsView on unpkg · L264

65Install-time code directly mutates a foreign AI-agent control surface: L157: const lines = Object.entries(vars).map(([k, v]) => `${k}=${v}`); L158: fs.writeFileSync(envPath, lines.join("\n") + "\n"); L159: // Contains ACK_AUTH_TOKEN -- the hook command below sources this file to ... L178: export function claudeSettingsPath() { L179: return path.join(os.homedir(), ".claude", "settings.json"); L180: } ... L189: const candidates = [ L190: { harness: "claude", marker: path.join(home, ".claude", "settings.json") }, L191: { harness: "hermes", marker: path.join(home, ".hermes") }, ... L233: L234: fs.mkdirSync(path.dirname(p), { recursive: true }); L235: fs.writeFileSync(p, JSON.stringify(settings, null, 2) + "\n"); Write operation from node/bin/postinstall.js: L65: const write = (line) => { L66:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

node/bin/install.jsView on unpkg · L65

•Trigger-reachable chain: scripts.postinstall -> node/bin/postinstall.js -> node/bin/install.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

node/bin/install.jsView on unpkg

python/tests/ack_monitor_multi_agent_test.pyView file

•path = python/tests/ack_monitor_multi_agent_test.py kind = payload_in_excluded_dir sizeBytes = 5026 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

•path = python/tests/ack_monitor_multi_agent_test.py kind = build_helper sizeBytes = 5026 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

node/bin/ack.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg

Findings

4 Critical5 High4 Medium4 Low

CriticalSame File Env Network Executionnode/bin/install.js

CriticalAi Agent Control Hijacknode/bin/install.js

CriticalTrigger Reachable Dangerous Capabilitynode/bin/install.js

CriticalPrevious Version Dangerous Deltanode/bin/ack.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdeploy/ack_watchdog.js

HighShell

HighPayload In Excluded Dirpython/tests/ack_monitor_multi_agent_test.py

HighKnown Malware Source Similaritydeploy/ack_watchdog.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperpython/tests/ack_monitor_multi_agent_test.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings