@ngockhoale/ukit@2.3.15
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent configuration mutator with broad permissions and automatic hooks, warranting a warning. No automatic npm lifecycle execution or concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A user runs ukit or ukit install in a project.
Impact
A project agent can receive expanded file and shell permissions plus automatic hook execution.
Mechanism
Explicit CLI scaffolding of project-local AI-agent configuration and hooks.
AI rationale
This is an explicit-user-command AI-agent configuration mutator with broad permissions and automatic hooks, warranting a warning. No automatic npm lifecycle execution or concrete malicious behavior was found.
Evidence
src/cli/index.jssrc/core/runInstallPipeline.jstemplates/.claude/settings.jsontemplates/.claude/hooks/vision-router.sh.claude/settings.json.claude/hooks/sensitive-data-guard.sh.claude/hooks/vision-router.sh.codex/settings.json.omp/config.yml
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked CLI defaults to the install command.
- Install applies a generated plan to the current project and then repairs hook settings.
- The shipped Claude settings template enables bypass permissions and registers command hooks.
- The shipped vision hook launches a local Node helper for each prompt.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The only runtime dependency is yaml; there is no self-dependency.
- No package code was found making an automatic network request or exfiltrating credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetemplates/.claude/hooks/sensitive-data-guard.shView file
•path = templates/.claude/hooks/sensitive-data-guard.sh
kind = payload_in_excluded_dir
sizeBytes = 12468
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/sensitive-data-guard.shView on unpkg•path = templates/.claude/hooks/sensitive-data-guard.sh
kind = build_helper
sizeBytes = 12468
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/sensitive-data-guard.shView on unpkgpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Findings
2 High7 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/sensitive-data-guard.sh
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/sensitive-data-guard.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencesrc/cli/index.js
MediumAi Review Evidencesrc/core/runInstallPipeline.js
MediumAi Review Evidencetemplates/.claude/settings.json
MediumAi Review Evidencetemplates/.claude/settings.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.3.15.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.3.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.