registry / @drdeeks/character-kit / 1.9.1

@drdeeks/character-kit@1.9.1

Agent character enforcement. Host-neutral core plus OpenAI, Claude, and Hermes companions. Fail-closed. Not a security boundary.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The lifecycle hook does not configure an agent, and the agent integration is performed through the separate configure flow. The flagged uninstall, indexer, hook, CLI, and watchdog behavior is scoped to ACK setup or runtime support, so the scanner hints do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation runs the postinstall hook; a separate user-run configure command performs setup.

Impact

The inspected paths do not establish unconsented agent configuration changes, credential disclosure, or other malicious effects.

Mechanism

Postinstall checks install context and prints setup guidance. The configure flow writes ACK hooks, while uninstall removes only ACK-marked hooks.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest runs postinstall and preuninstall hooks. Postinstall requires a global install inside node_modules and only reports setup commands; it does not configure the package.
Claude hook setup is in the separate installer flow and is conditional on its wiring option. The installer presents detected harnesses for an explicit selection.
Preuninstall has the same global-install guards and removes only ACK-marked hooks, leaving unrelated settings intact.
The knowledge indexer excludes agent-internal files and directories from its user-supplied corpus.
Harness detection checks for local marker paths; the Claude hook wrapper runs the ACK CLI, and the watchdog monitors and restarts ACK processes.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

10 flagged

package.jsonView file

Lines 15-55json

15 "./config-schema": "./packages/config-schema/src/index.js",

16 "./mcp-contract": "./packages/mcp-contract/src/index.js"

17 },

18 "bin": {

19 "ack": "node/bin/ack.js",

20 "character-kit": "node/bin/ack.js"

21 },

22 "type": "module",

23 "workspaces": [

24 "packages/*",

25 "apps/chatgpt-ack-mcp",

26 "plugins/openai",

27 "plugins/claude",

28 "plugins/hermes"

29 ],

30 "scripts": {

31 "test": "node --test node/tests/*.test.js packages/core/src/policy/engine.test.js packages/protocol/src/envelope.test.js packages/config-schema/src/*.test.js packages/events/src/*.test.js packages/daemon/src/*.test.js apps/chatgpt-ack-mcp/src/*.test.js plugins/openai/src/plugin-manifest.test.js plugins/claude/plugin-manifest.test.js",

32 "test:python": "python3 python/tests/python_parity_test.py && python3 python/tests/ack_monitor_multi_agent_test.py && python3 python/hermes_plugin/test_plugin.py",

33 "start": "node node/bin/ack.js",

34 "ack-install": "node node/bin/install.js",

35 "postinstall": "node node/bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "preuninstall": "node node/bin/preuninstall.js"

37 },

38 "keywords": [

39 "agent",

40 "character",

41 "agent-character",

42 "enforcement",

43 "hooks",

44 "yaml",

45 "claude",

46 "openai",

47 "hermes",

48 "opencode"

49 ],

50 "author": "drdeeks",

51 "license": "MIT",

52 "dependencies": {

53 "commander": "^11.1.0",

54 "gray-matter": "^4.0.3",

55 "js-yaml": "^4.3.2"

plugins/claude/hooks/ack-stdio.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

plugins/claude/hooks/ack-stdio.jsView on unpkg · L1

3import path from "node:path";

node/bin/install.jsView file

Lines 236-276javascript

236 for (const f of fs.readdirSync(src)) {

237 if (f.endsWith(".yaml") && !fs.existsSync(path.join(dst, f))) {

node/src/detect-harnesses.jsView file

Lines 1-20javascript

1/**

2 * Detect which agent harnesses look installed for this user.

3 * Kept tiny so postinstall can import it without loading install.js / gray-matter.

4 */

6import fs from "fs";

7import os from "os";

8import

python/agent_character_kit/semantic.pyView file

•path = python/agent_character_kit/semantic.py kind = build_helper sizeBytes = 4743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/agent_character_kit/semantic.pyView on unpkg

node/bin/ack.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node/bin/ack.js#virtual:normalized:round1View on unpkg

deploy/ack_watchdog.jsView file

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = deploy/ack_watchdog.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

deploy/ack_watchdog.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/claude/hooks/ack-stdio.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

plugins/claude/hooks/ack-stdio.jsView on unpkg · L1

Findings

4 Critical5 High5 Medium4 Low

CriticalSame File Env Network Executionnode/bin/install.js

CriticalAi Agent Control Hijacknode/src/detect-harnesses.js

CriticalTrigger Reachable Dangerous Capabilitynode/bin/install.js

CriticalPrevious Version Dangerous Deltanode/bin/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processplugins/claude/hooks/ack-stdio.js

HighShell

HighSemantic Analysis Limitednode/bin/ack.js#virtual:normalized:round1

HighKnown Malware Source Similaritydeploy/ack_watchdog.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @drdeeks/character-kit@1.9.1.

See all versions of @drdeeks/character-kit for other recorded verdicts.

Review the evidence and your use of @drdeeks/character-kit@1.9.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:23:21.993Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.