registry / @ngockhoale/ukit / 2.2.8
@ngockhoale/ukit@2.2.8
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious based on the reviewed source, but its explicit setup command installs a project-local agent extension that can broaden Bash permissions. This warrants a warning for dangerous capability rather than a publication block.
Static reason
No blocking static signals were detected.
Trigger
The user runs ukit install, then uses Claude Code in that project.
Impact
Future agent Bash commands may receive broader project-local permission without a separate approval prompt.
Mechanism
Project-local AI-agent configuration and hook installation with automatic Bash permission rules.
AI rationale
The package is not malicious based on the reviewed source, but its explicit setup command installs a project-local agent extension that can broaden Bash permissions. This warrants a warning for dangerous capability rather than a publication block.
Evidence
package.jsonsrc/cli/commands/install.jssrc/core/runInstallPipeline.jssrc/index/gitHooks.jsmanifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/auto-allow-bash.shtemplates/.claude/ukit/index/extract-image.mjs.claude/settings.json.claude/settings.local.json.claude/hooks/auto-allow-bash.sh.claude/hooks/auto-prune-bash.sh.claude/ukit/permission-usage.json.claude/ukit/permission-audit.log.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Benign with low false-positive risk.
Evidence for warning
- The explicit install command deploys Claude configuration and executable hooks into a project.
- The deployed Claude configuration enables permission bypass mode.
- A Bash pre-tool hook automatically adds allow rules for eligible command binaries.
- The hook excludes interpreters and several destructive commands, but can still broaden allowed Bash commands.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle hook.
- The agent configuration is installed only through the user-invoked ukit install command.
- No source evidence shows credential exfiltration, remote payload retrieval, or hidden network activity.
- Image handling is local and states it has no network calls.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcetemplates/.claude/hooks/vision-router.shView file
•path = templates/.claude/hooks/vision-router.sh
kind = payload_in_excluded_dir
sizeBytes = 8162
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/vision-router.shView on unpkg•path = templates/.claude/hooks/vision-router.sh
kind = build_helper
sizeBytes = 8162
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/vision-router.shView on unpkgtemplates/.claude/settings.jsonView file
16"permissions": {
"defaultMode": "bypassPermissions",
"allow": [
Medium
Findings
1 High5 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencetemplates/.claude/settings.json
MediumAi Review Evidencetemplates/.claude/hooks/auto-allow-bash.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.2.8.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.