@ngockhoale/ukit@2.1.3
Install/update an index-first AI workspace for Claude Code, Antigravity, OpenAI Codex, and OpenCode.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete exfiltration, remote payload execution, or unconsented npm lifecycle mutation was found. The explicit installer nevertheless creates and expands AI-agent permissions, so it warrants a warning under the agent-config mutation policy.
Static reason
No blocking static signals were detected.
Trigger
User runs `ukit` or `ukit install`, then uses the configured agent or Git hooks.
Impact
An installed Claude workspace can auto-allow additional command binaries and operate with bypassed permissions.
Mechanism
Explicit project-scoped AI-agent configuration and permission mutation.
AI rationale
No concrete exfiltration, remote payload execution, or unconsented npm lifecycle mutation was found. The explicit installer nevertheless creates and expands AI-agent permissions, so it warrants a warning under the agent-config mutation policy.
Evidence
package.jsonsrc/cli/index.jssrc/cli/commands/install.jssrc/index/gitHooks.jsmanifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/auto-allow-bash.sh.claude/settings.json.claude/settings.local.json.claude/hooks/auto-allow-bash.sh.codex/skills.codex/ukit.codex/settings.json.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `ukit install` deploys Codex agent links and settings.
- Claude template sets `bypassPermissions` and activates command hooks.
- A Bash hook adds encountered command binaries to Claude allow rules.
- Install adds local Git hooks that run the deployed index refresher.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Mutations require the user-invoked CLI install path; no credential harvesting or runtime network egress was found.
- Git hook payload is a local Node index refresh, not a remote payload loader.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcetemplates/.claude/hooks/vision-router.shView file
•path = templates/.claude/hooks/vision-router.sh
kind = payload_in_excluded_dir
sizeBytes = 8162
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/vision-router.shView on unpkg•path = templates/.claude/hooks/vision-router.sh
kind = build_helper
sizeBytes = 8162
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/vision-router.shView on unpkgmanifests/platform.full.yamlView file
1569- id: multi-codex-skills-link
type: link
sourceTemplate: .claude/skills
targetPath: .codex/skills
requires: []
enabledByDefault: true
packs:
- core
- id: multi-codex-ukit-link
type: link
sourceTemplate: .claude/ukit
targetPath: .codex/ukit
requires: []
enabledByDefault: true
Findings
1 High6 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencemanifests/platform.full.yaml
MediumAi Review Evidencetemplates/.claude/settings.json
MediumAi Review Evidencetemplates/.claude/hooks/auto-allow-bash.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.1.3.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.