@kaydash9999/banker-plugins@0.15.2
banker — Claude Code + Codex CLI plugin (QA, audit, docs, architecture, wiki skills). Install via Claude Code marketplace, or `npm i -g @kaydash9999/banker-plugins` then `banker setup`.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package is suspicious because it ships a user-invoked capability that can remove Claude Code’s tool confirmation prompts across sessions. The inspected source shows explicit confirmation and policy checks, so this does not support a publish block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the setup-bypass-permissions skill and confirms its `on` action.
Impact
Subsequent Claude Code sessions may run tools without asking first, increasing the risk of unintended file changes or commands.
Mechanism
The helper writes `permissions.defaultMode` as `bypassPermissions` in Claude Code settings, subject to policy checks.
AI rationale
The package is suspicious because it ships a user-invoked capability that can remove Claude Code’s tool confirmation prompts across sessions. The inspected source shows explicit confirmation and policy checks, so this does not support a publish block.
Evidence
skills/setup-bypass-permissions/scripts/bypass-permissions.mjsskills/setup-bypass-permissions/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines only a prepublishOnly lifecycle script; the launcher’s setup runs through its CLI command.
- The launcher copies package skills and commands into Claude Code or Codex locations when setup is requested; the manifest lists the distributed skills.
- The inspected helper defaults point to existing Claude or Codex configuration locations.
- The bypass-permissions helper can change Claude Code’s default permission mode to bypassPermissions.
- The skill requires explicit confirmation for `on` and presents warnings before asking.
- The other inspected helpers target the OMC HUD or user rules/configuration and are separate skill scripts.
Evidence against
- No npm preinstall, install, or postinstall hook was found.
- The bypass permission change is not automatic: the skill disables model invocation and requires the user to confirm after seeing the warnings.
- The helper refuses changes when policy blocks bypass mode and preserves the prior setting for restoration.
Behavioral surface
ChildProcessCrypto
Source & flagged code
6 flaggedbin/banker.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}`;
fs.writefilesync(skillmd, src.slice(0, fm.index) + `---\n${block}\n---` + src.slice(fm.index + fm[0].length));
}
function setupclaude(dryrun) {
log('• claude code:');
if (!have('claude')) { warn(' claude cli not found on path — install claude code first. skipping --claude.'); return false; }
const steps = [
['claude', ['plugin', 'marketplace', 'add', pkg_root]],
['claude', ['plugin', 'install', `${plugin_name}@${marketplace}`]],
];
for (const [bin, args] of steps) {
if (dryrun) { log(` [dry-run] ${bin} ${args.join(' ')}`); continu
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/banker.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @kaydash9999/banker-plugins@0.13.0
matchedIdentity = npm:[redacted]:0.13.0
similarity = 0.526
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/banker.jsView on unpkgFindings
3 High5 Medium6 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/banker.js
HighSemantic Analysis Limitedskills/payload-mon/scripts/payload-mon.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltabin/banker.js
MediumDynamic Requirebin/banker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/audit-web-page/harness.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoskills/payload-mon/scripts/payload-size.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kaydash9999/banker-plugins@0.15.2.
See all versions of @kaydash9999/banker-plugins for other recorded verdicts.
- Review the evidence and your use of @kaydash9999/banker-plugins@0.15.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.