registry / @golproductions/check / 4.1.5

@golproductions/check@4.1.5

Update to the latest: npx @golproductions/check@latest --install

Less hallucinations. A command firewall for Claude Code: validates every shell command before execution, so fabricated commands are denied before they run.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit installation command installs a persistent Claude Code hook and downloads its hook implementation. The hook transmits command-related data to the vendor service and can invoke local probes requested by that service.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the check binary with --install, then Claude Code invokes the installed hook.

Impact

A vendor-controlled hook can observe agent commands, affect their allow or deny outcome, and cause selected local checks to run.

Mechanism

Remote-backed global AI-agent command interception and probing.

AI rationale

This is an explicitly activated but opaque global AI-agent extension with remote hook delivery and command telemetry. It should be warned on rather than blocked because no npm install lifecycle trigger is present.

Evidence

dist/index.jsREADME.md~/.check/check.mjs~/.check/check-hook.mjs~/.check/key~/.claude/settings.json

Network endpoints1

triage.golproductions.com/preflight

Decision evidence

public snapshot

with false-positive risk.

@golproductions/check@4.1.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code