@ngockhoale/ukit@2.3.22
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not malicious by the inspected source, but its explicit installer changes an AI-agent control surface in a way that warrants a warning. No lifecycle hook or concrete exfiltration/destructive chain was found.
Static reason
No blocking static signals were detected.
Trigger
The user runs ukit install or an update path that reruns installation.
Impact
An affected project can grant its AI agent broad default permissions and execute installed hooks during Claude events.
Mechanism
Project-local Claude configuration and hook installation.
AI rationale
The package is not malicious by the inspected source, but its explicit installer changes an AI-agent control surface in a way that warrants a warning. No lifecycle hook or concrete exfiltration/destructive chain was found.
Evidence
src/cli/commands/install.jssrc/core/runInstallPipeline.jstemplates/.claude/settings.jsontemplates/.claude/hooks/task-watchdog.sh.claude/settings.json.claude/hooks/task-watchdog.sh.claude/ukit/runtime/task-watchdog.mjs.ukit/storage/config.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked install command runs the installer with writes enabled.
- The installer applies a template plan to the selected project and updates project configuration.
- The Claude settings template sets the default permission mode to bypass permissions.
- A shipped hook dynamically imports a project-local runtime module when relevant Claude events fire.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No package code inspected sends credentials, files, or hook input to a network endpoint.
- The sensitive-data hook detects likely secrets and blocks the associated AI action.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetemplates/.claude/hooks/task-watchdog.shView file
•path = templates/.claude/hooks/task-watchdog.sh
kind = payload_in_excluded_dir
sizeBytes = 8598
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/task-watchdog.shView on unpkg•path = templates/.claude/hooks/task-watchdog.sh
kind = build_helper
sizeBytes = 8598
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/task-watchdog.shView on unpkg69if (hookEvent !== 'Stop' && hookEvent !== 'PostToolUse') {
process.exit(0);
}
const runtimePath = path.join(projectRoot, '.claude', 'ukit', 'runtime', 'task-watchdog.mjs');
// Async existence check — sync fs here would violate the all-async invariant
// (a stalled mount would block the loop and the 3s self-kill could not fire).
try {
await fsp.access(runtimePath);
} catch {
process.exit(0);
}
let runtime;
try {
runtime = await import(pathToFileURL(runtimePath).href);
} catch {
process.exit(0);
}
const configPath = path.join(projectRoot, '.ukit',
Findings
2 High7 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencesrc/cli/commands/install.js
MediumAi Review Evidencesrc/core/runInstallPipeline.js
MediumAi Review Evidencetemplates/.claude/settings.json
MediumAi Review Evidencetemplates/.claude/hooks/task-watchdog.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.3.22.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.3.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.