@ngockhoale/ukit@2.3.20
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo automatic lifecycle hook, self-dependency, remote payload, or data exfiltration was found. The explicit installer nevertheless modifies AI-agent control surfaces and dynamically broadens command permissions.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running `ukit` or `ukit install` in a project.
Impact
Installed agents can gain persistent wildcard permissions for additional command binaries within that project.
Mechanism
Project-level AI-agent configuration deployment with dynamic Bash permission grants.
AI rationale
No automatic lifecycle hook, self-dependency, remote payload, or data exfiltration was found. The explicit installer nevertheless modifies AI-agent control surfaces and dynamically broadens command permissions.
Evidence
src/cli/index.jsmanifests/platform.full.yamltemplates/.claude/hooks/auto-allow-bash.sh.claude/settings.json.claude/settings.local.json.claude/hooks/task-watchdog.sh.claude/ukit/permission-usage.json.claude/ukit/permission-audit.log.codex/skills.codex/ukit.codex/agents.codex/settings.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI defaults to its install command and deploys project-level AI workspace assets.
- The manifest overwrites Claude settings and installs executable hooks in the consumer project.
- A deployed hook dynamically adds wildcard Bash permission rules to the project's local Claude settings.
- The default install also creates Codex links and writes Codex settings.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle script.
- No source-inspected network exfiltration or remote payload download was found.
- The permission hook excludes shell interpreters and several destructive command names.
- The configuration changes require an explicit CLI invocation rather than npm installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetemplates/.claude/hooks/task-watchdog.shView file
•path = templates/.claude/hooks/task-watchdog.sh
kind = payload_in_excluded_dir
sizeBytes = 8598
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/task-watchdog.shView on unpkg•path = templates/.claude/hooks/task-watchdog.sh
kind = build_helper
sizeBytes = 8598
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/task-watchdog.shView on unpkgpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
Findings
3 High6 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedpackage.json
HighPrevious Version Dangerous Deltascripts/release/verify-release.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencesrc/cli/index.js
MediumAi Review Evidencemanifests/platform.full.yaml
MediumAi Review Evidencemanifests/platform.full.yaml
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.3.20.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.3.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.