@ngockhoale/ukit@2.2.12
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious npm install-hook abuse because it requires an explicit CLI setup command and has no registry lifecycle hook. The broad agent permission configuration and automatic allow-list expansion warrant a warning.
Static reason
No blocking static signals were detected.
Trigger
The user runs ukit install, then Claude invokes a Bash tool call in that project.
Impact
Reduces future Claude permission prompts and can broaden the agent's command capability within the opted-in project.
Mechanism
Project-local Claude permission and hook configuration mutation.
AI rationale
This is not malicious npm install-hook abuse because it requires an explicit CLI setup command and has no registry lifecycle hook. The broad agent permission configuration and automatic allow-list expansion warrant a warning.
Evidence
manifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/auto-allow-bash.sh.claude/settings.json.claude/settings.local.json.claude/hooks/auto-allow-bash.sh.claude/ukit/permission-usage.json.claude/ukit/permission-audit.log
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit ukit install command deploys a Claude settings file and hooks into the consumer project.
- The deployed settings use bypassPermissions and permit editing, writing, and selected shell commands.
- A Bash pre-tool hook automatically adds new command allow rules to project-local Claude settings.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- The control-surface changes require a user-invoked CLI install, not package installation.
- No credential exfiltration, remote payload download, or self-dependency was found in inspected sources.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetemplates/.claude/hooks/vision-router.shView file
•path = templates/.claude/hooks/vision-router.sh
kind = payload_in_excluded_dir
sizeBytes = 8162
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/vision-router.shView on unpkg•path = templates/.claude/hooks/vision-router.sh
kind = build_helper
sizeBytes = 8162
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/vision-router.shView on unpkgpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High7 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencemanifests/platform.full.yaml
MediumAi Review Evidencetemplates/.claude/settings.json
MediumAi Review Evidencetemplates/.claude/hooks/auto-allow-bash.sh
MediumAi Review Evidencetemplates/.claude/settings.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.2.12.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.2.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.