registry / @ngockhoale/ukit / 2.3.0
@ngockhoale/ukit@2.3.0
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is not malicious install-hook abuse because there is no npm lifecycle execution and configuration occurs through an explicit user CLI command. It remains a guarded agent-extension lifecycle risk because it persists hooks and agent settings in the project.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the UKit CLI install command and subsequently uses the configured AI agent.
Impact
The package gains persistent control over configured agent behavior in that project; the image routing hook can direct an agent to retrieve user-supplied image URLs.
Mechanism
Project-level AI-agent configuration and hook installation.
AI rationale
This is not malicious install-hook abuse because there is no npm lifecycle execution and configuration occurs through an explicit user CLI command. It remains a guarded agent-extension lifecycle risk because it persists hooks and agent settings in the project.
Evidence
manifests/platform.full.yamltemplates/.claude/settings.jsontemplates/.claude/hooks/vision-router.sh.claude/settings.json.claude/hooks/sensitive-data-guard.sh.claude/hooks/vision-router.sh.claude/ukit/.codex/settings.json.codex/skills.codex/agents
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit UKit CLI installs project-level Claude and Codex control files, including settings and agent links.
- Installed Claude settings register command hooks that run on agent tool events.
- The vision hook runs a local extractor on prompt input and directs an agent to download image URLs.
Evidence against
- package.json has no npm lifecycle hook, so installation does not automatically execute this behavior.
- The sensitive-data hook blocks detected secrets and redacts output rather than sending values elsewhere.
- No package-controlled network endpoint or credential exfiltration path was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetemplates/.claude/hooks/sensitive-data-guard.shView file
•path = templates/.claude/hooks/sensitive-data-guard.sh
kind = payload_in_excluded_dir
sizeBytes = 11235
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/sensitive-data-guard.shView on unpkg•path = templates/.claude/hooks/sensitive-data-guard.sh
kind = build_helper
sizeBytes = 11235
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/sensitive-data-guard.shView on unpkgpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Findings
3 High6 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/sensitive-data-guard.sh
HighSemantic Analysis Limitedpackage.json
HighPrevious Version Dangerous Deltascripts/release/verify-release.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/sensitive-data-guard.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencemanifests/platform.full.yaml
MediumAi Review Evidencemanifests/platform.full.yaml
MediumAi Review Evidencetemplates/.claude/settings.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.3.0.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.