@ngockhoale/ukit@2.2.5

Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No malicious chain was found, but explicit installation deploys an AI-agent control extension with bypass-permissions settings and executable hooks. This is a guarded first-party extension risk, not an npm lifecycle compromise.

Static reason

No blocking static signals were detected.

Trigger

A user runs ukit or ukit install in a project.

Impact

The installed configuration can change Claude Code permissions and run local hooks during agent events.

Mechanism

Project-local AI-agent settings and hook installation.

AI rationale

Evidence

package.jsonsrc/cli/index.jssrc/cli/commands/install.jssrc/core/runInstallPipeline.jssrc/core/applyPlan.jsmanifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/vision-router.shtemplates/.claude/hooks/block-dangerous.sh.claude/settings.json.claude/hooks/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Benign with medium false-positive risk.

Evidence for warning

The explicit CLI install path writes a Claude Code settings file and many executable hook templates into the current project.
The installed Claude settings select bypass-permissions mode and invoke hooks for edit, shell, and prompt events.
A prompt hook reads prompt data and starts a local Node helper; it does not itself download URL images.
This is a first-party AI workspace extension installed only when the user runs the CLI, not during npm installation.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
No network client or outbound request implementation was found in executable package source.
The reviewed shell hook blocks destructive shell patterns rather than executing them.
The installer writes through a manifest and tracks managed project paths; no credential collection or exfiltration was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Source & flagged code

5 flagged

templates/.claude/hooks/vision-router.shView file

•path = templates/.claude/hooks/vision-router.sh kind = payload_in_excluded_dir sizeBytes = 8162 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/vision-router.shView on unpkg

•path = templates/.claude/hooks/vision-router.sh kind = build_helper sizeBytes = 8162 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/vision-router.shView on unpkg

src/cli/commands/install.jsView file

Lines 178-218javascript

178 console.log(

179 `[UKit] Skipping removal of ${relativePath} because it is not a symlink. Remove it manually if intended.`,

180 );

181 await removeTrackedPathsFromMetadata({

182 installMetaPath,

183 projectRoot,

184 removeRelativePaths: [relativePath],

185 });

186 }

187 }

188

189 console.log(`[UKit] Removed ${removedCount} ${adapter.label} path(s).`);

190 }

191 } finally {

192 line.close();

193 }

194

195 return { retainedManagedPaths: [...new Set(retainedManagedPaths)] };

196}

197

198export async function runInstall({ packageRoot, projectRoot, packageVersion, argv = [] }) {

199 const toolsArg = parseToolsArg(argv);

200 const selectedOptionalTools = resolveOptionalToolKeys(toolsArg);

201 const withCodegraph = argv.includes('--with-codegraph');

Medium

Ai Review Evidence

The explicit CLI install path writes a Claude Code settings file and many executable hook templates into the current project.

src/cli/commands/install.jsView on unpkg · L198

202

203 const pruneResult = await pruneDeselectedAdapters({

204 projectRoot,

205 optionalToolKeys: selectedOptionalTools,

206 });

207

208 const selectedAdapterItemIds = toSelectedAdapterItemIds(selectedOptionalTools);

209 const pathConfig = buildPathConfig({ packageRoot, projectRoot });

210

211 const result = await runInstallPipeline({

212 packageVersion,

213 pathConfig,

214 dryRun: false,

215 selectedAdapterItemIds,

216 retainedManagedRelativePaths: pruneResult?.retainedManagedPaths ?? [],

217 withCodegraph,

218 });

manifests/platform.full.yamlView file

Lines 943-983yaml

943 requires:

944 - command-handoff-create

945 mergeStrategy: overwrite_with_backup

946 variables: []

947 enabledByDefault: true

948 packs:

templates/.claude/settings.jsonView file

Lines 33-73json

33 "Bash(git add:*)",

34 "Bash(git commit:*)",

35 "Bash(git push:*)",

36 "Bash(git worktree:*)",

37 "Bash(jq:*)"

38 ],

39 "ask": [

Source & flagged code

5 flagged · loading source

templates/.claude/hooks/vision-router.shView file

•path = templates/.claude/hooks/vision-router.sh kind = payload_in_excluded_dir sizeBytes = 8162 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/vision-router.shView on unpkg

•path = templates/.claude/hooks/vision-router.sh kind = build_helper sizeBytes = 8162 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/vision-router.shView on unpkg

src/cli/commands/install.jsView file

198export async function runInstall({ packageRoot, projectRoot, packageVersion, argv = [] }) { const toolsArg = parseToolsArg(argv); const selectedOptionalTools = resolveOptionalToolKeys(toolsArg); const withCodegraph = argv.includes('--with-codegraph');

Findings

1 High6 Medium3 Low

HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh

MediumEnvironment Vars

MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencesrc/cli/commands/install.js

MediumAi Review Evidencemanifests/platform.full.yaml

MediumAi Review Evidencetemplates/.claude/settings.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @ngockhoale/ukit@2.2.5.

See all versions of @ngockhoale/ukit for other recorded verdicts.

Review the evidence and your use of @ngockhoale/ukit@2.2.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 08:28:33.421Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code