registry / @drdeeks/character-kit / 1.8.0

@drdeeks/character-kit@1.8.0

Agent character enforcement. Host-neutral core plus OpenAI, Claude, and Hermes companions. Fail-closed. Not a security boundary.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The lifecycle hook does not configure an agent, and the Claude settings change occurs through the separate installer flow. The inspected uninstall logic removes only ACK-marked hooks, so the scanner’s risk labels are not supported as malicious behavior by these sources.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation runs postinstall; agent configuration requires invoking the installer command.

Impact

No unconsented agent configuration change or other concrete attack was established.

Mechanism

Postinstall checks installation context, detects harness markers, and prints guidance. The explicit installer adds its own hooks, and preuninstall removes ACK-marked entries.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest’s postinstall hook runs node/bin/postinstall.js; its source gates output on a global install inside node_modules and directs users to run setup separately.
The installer’s Claude settings target is the user’s .claude/settings.json; its hook entries are added by the installer flow.
Preuninstall removes ACK-marked Claude hooks while preserving unrelated settings.
The knowledge indexer’s cited location lists agent configuration filenames among files excluded from indexing.
The Claude hook launcher runs the ACK command and exits nonzero if it cannot run.
Harness detection checks for local marker paths and returns detected harness names.

Evidence against

No attack was identified: postinstall only detects installed harnesses and prints setup guidance; it does not configure them.
Agent hook setup is performed by the separate installer command, and uninstall cleanup is limited to ACK-marked hook entries.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

10 flagged

package.jsonView file

Lines 12-52json

12 "./cli": "./packages/cli/src/index.js",

13 "./daemon": "./packages/daemon/src/index.js",

14 "./hooks": "./node/src/hooks/character.js"

15 },

16 "bin": {

17 "ack": "node/bin/ack.js",

18 "character-kit": "node/bin/ack.js"

19 },

20 "type": "module",

21 "workspaces": [

22 "packages/*",

23 "plugins/openai",

24 "plugins/claude",

25 "plugins/hermes"

26 ],

27 "scripts": {

28 "test": "node --test node/tests/*.test.js packages/core/src/policy/engine.test.js packages/protocol/src/envelope.test.js packages/daemon/src/*.test.js plugins/openai/src/plugin-manifest.test.js plugins/claude/plugin-manifest.test.js",

29 "test:python": "python3 python/tests/python_parity_test.py && python3 python/tests/ack_monitor_multi_agent_test.py && python3 python/hermes_plugin/test_plugin.py",

30 "start": "node node/bin/ack.js",

31 "ack-install": "node node/bin/install.js",

32 "postinstall": "node node/bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "preuninstall": "node node/bin/preuninstall.js"

34 },

35 "keywords": [

36 "agent",

37 "character",

38 "agent-character",

39 "enforcement",

40 "hooks",

41 "yaml",

42 "claude",

43 "openai",

44 "hermes",

45 "opencode"

46 ],

47 "author": "drdeeks",

48 "license": "MIT",

49 "dependencies": {

50 "commander": "^11.1.0",

51 "gray-matter": "^4.0.3",

52 "js-yaml": "^4.3.2"

plugins/claude/hooks/ack-stdio.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

plugins/claude/hooks/ack-stdio.jsView on unpkg · L1

3import path from "node:path";

node/bin/install.jsView file

Lines 236-276javascript

236 for (const f of fs.readdirSync(src)) {

237 if (f.endsWith(".yaml") && !fs.existsSync(path.join(dst, f))) {

node/src/detect-harnesses.jsView file

Lines 1-20javascript

1/**

2 * Detect which agent harnesses look installed for this user.

3 * Kept tiny so postinstall can import it without loading install.js / gray-matter.

4 */

6import fs from "fs";

7import os from "os";

8import

python/agent_character_kit/semantic.pyView file

•path = python/agent_character_kit/semantic.py kind = build_helper sizeBytes = 4743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/agent_character_kit/semantic.pyView on unpkg

node/bin/ack.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node/bin/ack.js#virtual:normalized:round1View on unpkg

deploy/ack_watchdog.jsView file

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = deploy/ack_watchdog.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

deploy/ack_watchdog.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/claude/hooks/ack-stdio.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

plugins/claude/hooks/ack-stdio.jsView on unpkg · L1

Findings

4 Critical5 High5 Medium4 Low

CriticalSame File Env Network Executionnode/bin/install.js

CriticalAi Agent Control Hijacknode/src/detect-harnesses.js

CriticalTrigger Reachable Dangerous Capabilitynode/bin/install.js

CriticalPrevious Version Dangerous Deltanode/bin/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processplugins/claude/hooks/ack-stdio.js

HighShell

HighSemantic Analysis Limitednode/bin/ack.js#virtual:normalized:round1

HighKnown Malware Source Similaritydeploy/ack_watchdog.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @drdeeks/character-kit@1.8.0.

See all versions of @drdeeks/character-kit for other recorded verdicts.

Review the evidence and your use of @drdeeks/character-kit@1.8.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:18:18.039Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.