@ngockhoale/ukit@2.2.10
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit user-command AI workspace installer with broad agent permissions and dynamic permission mutation. It warrants a warning for dangerous capability, not a publish block, because no concrete malicious install-time chain or exfiltration was found.
Static reason
No blocking static signals were detected.
Trigger
A user runs ukit or ukit install in a project, then uses the configured AI tool.
Impact
The configured AI agent can gain broad project command and write capability with reduced approval friction.
Mechanism
Project-local AI-agent configuration, hooks, and dynamic Bash permission expansion.
AI rationale
This is an explicit user-command AI workspace installer with broad agent permissions and dynamic permission mutation. It warrants a warning for dangerous capability, not a publish block, because no concrete malicious install-time chain or exfiltration was found.
Evidence
src/cli/index.jsmanifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/auto-allow-bash.shsrc/index/gitHooks.js.claude/settings.json.claude/settings.local.json.claude/hooks/auto-allow-bash.sh.claude/ukit/permission-usage.json.claude/ukit/permission-audit.log.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit install command deploys a project-local Claude configuration and hook suite.
- The deployed Claude configuration sets permission bypass mode and permits editing, writing, Git commits, and Git pushes.
- A Bash hook automatically adds allow rules for newly encountered command binaries to the project-local permission file.
- The manifest installs agent and hook files into the consumer project's AI-tool control surface.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No source evidence of credential collection, secret exfiltration, remote payload loading, or a package-controlled network endpoint was found.
- The configuration changes occur only after the user invokes the ukit CLI; they are not npm-install-time behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcetemplates/.claude/hooks/vision-router.shView file
•path = templates/.claude/hooks/vision-router.sh
kind = payload_in_excluded_dir
sizeBytes = 8162
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/vision-router.shView on unpkg•path = templates/.claude/hooks/vision-router.sh
kind = build_helper
sizeBytes = 8162
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/vision-router.shView on unpkgtemplates/.claude/hooks/auto-allow-bash.shView file
115const allow = settings.permissions.allow;
let changed = false;
if (!allow.includes(rule)) {
allow.push(rule);
changed = true;
appendAudit("auto_add", { rule });
}
const prevMeta = usage.managedRules[rule] || {};
usage.managedRules[rule] = {
firstSeen: prevMeta.firstSeen || nowUtc,
lastSeen: nowUtc,
};
const managedSorted = Object.entries(usage.managedRules).sort((a, b) => {
const ta = Date.parse(a[1]?.lastSeen || "") || 0;
const tb = Date.parse(b[1]?.lastSeen || "") || 0;
return tb - ta;
});
if (managedSorted.length > maxRules) {
const evict = managedSorted.slice(maxRules
Findings
1 High5 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencetemplates/.claude/hooks/auto-allow-bash.sh
MediumAi Review Evidencemanifests/platform.full.yaml
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.2.10.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.2.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.