registry / @inkeep/open-knowledge / 0.63.7
@inkeep/open-knowledge@0.63.7
Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a meaningful automatic AI-agent extension lifecycle, so it warrants a warning. Its source does not establish malicious behavior or justify a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs `ok start`.
Impact
The package can change instructions available to AI tools on the machine.
Mechanism
Copies bundled skill directories into detected AI-editor skill locations and reports install telemetry.
AI rationale
The package has a meaningful automatic AI-agent extension lifecycle, so it warrants a warning. Its source does not establish malicious behavior or justify a publish block.
Evidence
package.jsondist/repair-skills-DquHsHSZ.mjsdist/skill-teardown-DLbNuqvC.mjsdist/src-2igu-66q.mjs
Network endpoints1
add-skill.vercel.sh
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI states that its skill repair runs automatically during `ok start` and refreshes bundled skills in installed AI editors at project and user scope.
- The repair routine deletes and recreates skill directories before copying bundled content.
- The package acknowledges that earlier releases installed skills into agent tools users may not have used.
- It reports skill-install telemetry to add-skill.vercel.sh.
Evidence against
- package.json has no npm preinstall, install, postinstall, or prepare hook.
- The extension behavior requires running the CLI, rather than occurring at package installation.
- No source evidence found of credential harvesting, remote payload execution, or destructive behavior outside managed skill paths.
- The native loader is generated NAPI platform-selection code, not a demonstrated attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindings
Source & flagged code
17 flagged · loading sourcedist/lib-B82GtN9K.mjsView file
39patternName = private_key_rsa
severity = critical
line = 39
matchedText = -----END...----
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/lib-B82GtN9K.mjsView on unpkg · L3939patternName = private_key_rsa
severity = critical
line = 39
matchedText = -----END...----
Critical
1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BR9ZCXZF.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor...
L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,`
...
L38: Y3FblSokcA==
L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY-----
L40: [redacted]
...
L67: \r
L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=...
L69:
...
L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}...
L72: `);let o=a;s
Findings
3 Critical10 High7 Medium8 Low
CriticalCritical Secretdist/lib-B82GtN9K.mjs
CriticalTrojan Source Unicodedist/public/assets/ku-TR-6OUDTVRD-CdE2By-R.js
CriticalSecret Patterndist/lib-B82GtN9K.mjs
HighChild Processdist/native/index.js
HighShell
HighCross File Remote Execution Contextdist/js-exec-VXN6TZ7U-Ds5SsewK.mjs
HighSemantic Analysis Limiteddist/dist-bundle-EXrl9_Zm.mjs
HighKnown Malware Source Similaritydist/native/index.js
HighKnown Malware Source Similaritydist/open-browser-W5CxYsJ4.mjs
HighKnown Malware Source Similaritydist/chunk-WRU74C26-BESBlKtm.mjs
HighKnown Malware Source Similaritydist/chunk-ZIRB5QZD-B2znOhor.mjs
Affected versions and remediation
This report applies to @inkeep/open-knowledge@0.63.7.
See all versions of @inkeep/open-knowledge for other recorded verdicts.
- Review the evidence and your use of @inkeep/open-knowledge@0.63.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.