@kaydash9999/banker-plugins@0.16.3
banker — Claude Code + Codex CLI plugin (QA, audit, docs, architecture, wiki skills). Install via Claude Code marketplace, or `npm i -g @kaydash9999/banker-plugins` then `banker setup`.
AI Security Review
scanned 24d ago · by lpm-firewall-aiStatic inspection found no install-time attack. The explicit `on --yes` utility can remove Claude Code tool confirmations, a concrete agent capability that warrants a warning despite its user-controlled activation.
Static reason
No blocking static signals were detected.
Trigger
A user runs the bypass-permissions command with `on --yes`.
Impact
Subsequent tool execution can proceed without confirmation while the setting remains enabled.
Mechanism
The utility writes `bypassPermissions` as Claude Code's default permission mode and records the previous mode for restoration.
AI rationale
Static inspection found no install-time attack. The explicit `on --yes` utility can remove Claude Code tool confirmations, a concrete agent capability that warrants a warning despite its user-controlled activation.
Evidence
skills/setup-bypass-permissions/scripts/bypass-permissions.mjs~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and has only a publish-time version check; it defines no npm install hook.
- The reported helpers point to user agent configuration locations, and the bypass utility accepts only the exact `on --yes` command.
- When enabled, the bypass utility sets Claude Code's `defaultMode` to `bypassPermissions`, allowing tool execution without confirmation; it retains the prior mode for restoration.
- The other inspected integration locations concern plugin paths, a statusline HUD, or user instruction files; no unconsented broad agent configuration write was established.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/banker.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}`;
fs.writefilesync(skillmd, src.slice(0, fm.index) + `---\n${block}\n---` + src.slice(fm.index + fm[0].length));
}
function setupclaude(dryrun) {
log('• claude code:');
if (!have('claude')) { warn(' claude cli not found on path — install claude code first. skipping --claude.'); return false; }
const steps = [
['claude', ['plugin', 'marketplace', 'add', pkg_root]],
['claude', ['plugin', 'install', `${plugin_name}@${marketplace}`]],
];
for (const [bin, args] of steps) {
if (dryrun) { log(` [dry-run] ${bin} ${args.join(' ')}`); continu
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/banker.jsView on unpkg9*/
L10: const fs = require('fs');
L11: const os = require('os');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/banker.jsView on unpkg · L9skills/payload-mon/scripts/payload-size.mjs
Findings
3 High5 Medium6 Low
HighExternal Ai Agent Control Surface Mutationskills/omc-patch/scripts/omc-patch.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/banker.js
HighSemantic Analysis Limitedskills/payload-mon/scripts/payload-mon.mjs#virtual:normalized:round1
MediumDynamic Requirebin/banker.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/audit-web-page/harness.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoskills/payload-mon/scripts/payload-size.mjs
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @kaydash9999/banker-plugins@0.16.3.
See all versions of @kaydash9999/banker-plugins for other recorded verdicts.
- Review the evidence and your use of @kaydash9999/banker-plugins@0.16.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.