@ngockhoale/ukit@2.2.6

Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No concrete malicious chain was found. It warrants a warning because an explicit command configures AI-agent control surfaces and Git hooks in the target project.

Static reason

No blocking static signals were detected.

Trigger

The user runs ukit install in a project.

Impact

The tool can influence supported AI-agent behavior in that project and add Git hook automation; no exfiltration or remote payload execution was confirmed.

Mechanism

Project-local agent extension and managed Git-hook setup.

AI rationale

No concrete malicious chain was found. It warrants a warning because an explicit command configures AI-agent control surfaces and Git hooks in the target project.

Evidence

package.jsonsrc/cli/commands/install.jssrc/core/runInstallPipeline.jssrc/index/gitHooks.jsmanifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/vision-router.sh.claude/settings.json.claude/hooks/.codex/settings.json.codex/skills.codex/ukit.codex/agents.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit install command applies a project installation plan.
The manifest installs Claude settings and bundled hook files into the project.
The explicit install command also adds managed Git refresh hooks.
A prompt hook invokes a local Node image helper.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle script.
No credential harvesting, network client, or exfiltration path was found in the inspected source.
The image URL handling is documented as detection only; the hook does not download URLs.
Agent configuration changes are part of the package's stated workspace-install purpose and require a user command.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 523 KB of source

Source & flagged code

6 flagged

templates/.claude/hooks/vision-router.shView file

Lines 54-111text

54 return !!mod.detectUnicGateway({ rootDir: projectRoot })?.unicMode;

55 } catch {

56 return null;

57 }

58 }

60 const unicMode = await detectUnicModeSafe();

62 // Off the UNIC gateway Claude reads images natively, so there is nothing to route and

63 // nothing to gate. Exit before marking anything: an armed marker that the gate will

64 // stand down on anyway is pure noise, and the advice text used to demand an analyst run

65 // whose receipt could never be accepted. Only a POSITIVE false short-circuits; null

66 // (detection failed) still routes, matching the gate's fail-safe direction.

67 //

68 // Cheaper than the old order, too: this replaces an execFileSync node spawn per prompt

69 // with one local import on the overwhelmingly common off-gateway path.

70 if (unicMode === false) {

71 process.exit(0);

72 }

74 // URL images are checked first and stripped out so the local-path regex never

75 // re-matches the tail of a URL (case c is a hint-only lane — no download here).

76 const URL_IMAGE_RE = /https?:\/\/\S+\.(?:png|jpe?g|gif|webp)\b/gi;

77 const LOCAL_PATH_RE = /\S+\.(?:png|jpe?g|gif|webp|bmp)\b/gi;

Medium

Ai Review Evidence

A prompt hook invokes a local Node image helper.

templates/.claude/hooks/vision-router.shView on unpkg · L74

79 const urlMatches = promptText.match(URL_IMAGE_RE) || [];

80 const textWithoutUrls = promptText.replace(URL_IMAGE_RE, ' ');

81 const localMatches = textWithoutUrls.match(LOCAL_PATH_RE) || [];

83 // Shell out to the single owner of image detection + marker writing. Runs on every

84 // prompt (cheap: --detect --mark-pending, never decodes). All three input forms are

85 // armed here, not just pasted images: a path or URL that only produced hint text would

86 // leave Edit/Write ungated, which is exactly the "analyse blind" case this cycle exists

87 // to prevent. --ref hashes a local file's bytes / a URL string inside the extractor.

88 let markedPasted = 0;

89 let markedPath = 0;

90 let markedUrl = 0;

91 const extractorPath = path.join(projectRoot, '.claude', 'ukit', 'index', 'extract-image.mjs');

92 if (fs.existsSync(extractorPath)) {

93 const args = [extractorPath, '--detect', '--mark-pending', '--json'];

94 if (typeof payload?.transcript_path === 'string' && payload.transcript_path.trim()) {

95 args.push('--session', payload.transcript_path.trim());

96 }

97 if (typeof payload?.session_id === 'string' && payload.session_id.trim()) {

98 args.push('--session-id', payload.session_id.trim());

99 }

100 for (const ref of [...localMatches, ...urlMatches]) {

101 args.push('--ref', ref);

Medium

Ai Review Evidence

A prompt hook invokes a local Node image helper.

templates/.claude/hooks/vision-router.shView on unpkg · L91

102 }

103 try {

104 const out = execFileSync('node', args, {

105 cwd: projectRoot,

106 encoding: 'utf8',

107 timeout: 6000,

108 });

109 const parsed = JSON.parse(out);

110 const images = Array.isArray(parsed?.images) ? parsed.images : [];

111 // Ref markers carry a `source`; pasted ones do not. Counting this way stays correct

•path = templates/.claude/hooks/vision-router.sh kind = payload_in_excluded_dir sizeBytes = 8162 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/vision-router.shView on unpkg

•path = templates/.claude/hooks/vision-router.sh kind = build_helper sizeBytes = 8162 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/vision-router.shView on unpkg

src/cli/commands/install.jsView file

Lines 188-228javascript

188

189 console.log(`[UKit] Removed ${removedCount} ${adapter.label} path(s).`);

190 }

191 } finally {

192 line.close();

193 }

194

manifests/platform.full.yamlView file

Lines 943-983yaml

943 requires:

944 - command-handoff-create

945 mergeStrategy: overwrite_with_backup

946 variables: []

947 enabledByDefault: true

948 packs:

Source & flagged code

6 flagged · loading source

templates/.claude/hooks/vision-router.shView file

•path = templates/.claude/hooks/vision-router.sh kind = payload_in_excluded_dir sizeBytes = 8162 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/vision-router.shView on unpkg

•path = templates/.claude/hooks/vision-router.sh kind = build_helper sizeBytes = 8162 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/vision-router.shView on unpkg

91const extractorPath = path.join(projectRoot, '.claude', 'ukit', 'index', 'extract-image.mjs'); if (fs.existsSync(extractorPath)) { const args = [extractorPath, '--detect', '--mark-pending', '--json']; if (typeof payload?.transcript_path === 'string' && payload.transcript_path.trim()) { args.push('--session', payload.transcript_path.trim()); } if (typeof payload?.session_id === 'string' && payload.session_id.trim()) { args.push('--session-id', payload.session_id.trim()); } for (const ref of [...localMatches, ...urlMatches]) { args.push('--ref', ref

Findings

1 High7 Medium3 Low

HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh

MediumEnvironment Vars

MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencesrc/cli/commands/install.js

MediumAi Review Evidencemanifests/platform.full.yaml

MediumAi Review Evidencetemplates/.claude/hooks/vision-router.sh

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @ngockhoale/ukit@2.2.6.

See all versions of @ngockhoale/ukit for other recorded verdicts.

Review the evidence and your use of @ngockhoale/ukit@2.2.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 16:51:48.882Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code