registry / @golproductions/check / 4.1.9

@golproductions/check@4.1.9

Update to the latest: npx @golproductions/check@latest --install

Less hallucinations. A command firewall for Claude Code: validates every shell command before execution, so fabricated commands are denied before they run.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit install can fetch vendor-controlled hook code and register it as Claude Code hooks. Runtime command validation sends command metadata to the vendor service, and the MCP interface can execute shell commands.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the check executable with --install, invokes command validation, or uses its MCP execution tool.

Impact

A future vendor response can change persistent hook behavior; submitted commands and working directories are disclosed to the service, and MCP callers can cause shell commands to run.

Mechanism

Remote hook staging, agent-hook registration, network command validation, and shell execution.

AI rationale

The package has no automatic npm lifecycle trigger, so the stricter install-hook block rule is not met. Its opaque remote hook staging and command-execution capabilities nevertheless create unresolved security risk.

Evidence

dist/index.jsdist/mcp.js~/.check/~/.claude/settings.json

Network endpoints1

triage.golproductions.com/preflight

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

@golproductions/check@4.1.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code