@ngockhoale/ukit@2.7.6
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected configuration writes are user-triggered installer behavior and are bounded to repairing invalid hook registrations and applying gateway resilience defaults. This warrants a warning for explicit agent configuration mutation, but the inspected source does not establish a malicious attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the UKit install command in a project.
Impact
These changes affect Claude Code project configuration; inspected behavior does not establish credential exposure or malicious control.
Mechanism
The install pipeline may remove invalid Claude hook registrations with a backup and add gateway resilience defaults when a custom gateway is configured.
AI rationale
The inspected configuration writes are user-triggered installer behavior and are bounded to repairing invalid hook registrations and applying gateway resilience defaults. This warrants a warning for explicit agent configuration mutation, but the inspected source does not establish a malicious attack.
Evidence
src/core/repairBrokenHooks.jssrc/core/gatewayResilienceEnv.js
Decision evidence
public snapshotAI called this Suspicious at 75.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes installation as an explicit command; the manifest has no install lifecycle hook.
- The install pipeline checks Claude settings and removes only registrations that fail hook schema validation, saving a backup before rewriting changed settings.
- When a custom gateway is configured, installation can add UKit resilience defaults to the project Claude settings while preserving user-set values.
- No concrete attack behavior was identified in the inspected hook and installer paths.
Evidence against
- The inspected package has no registry install lifecycle hook, and the settings changes are tied to the explicit install command.
- The watchdog stages bounded hook input and delegates decisions to the workspace runtime; inspected behavior showed no credential collection or network transmission.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
Source & flagged code
7 flagged · loading sourcescripts/bench/runGold.mjsView file
110const rootDir = projectRoot ?? REPO_ROOT;
L111: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L112: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L110src/core/memory/migrate.jsView file
1// Memory v1 → v2 migration — SPEC §4.
L2: // Idempotent: marker v2/migrated-from-v1.json; re-run is a no-op.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/memory/migrate.jsView on unpkg · L1templates/.claude/hooks/task-watchdog.shView file
Findings
3 High5 Medium4 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/perf/audit-perf.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltascripts/bench/parallel-agents.mjs
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencesrc/cli/commands/install.js
LowScripts Present
LowWeak Cryptosrc/core/memory/migrate.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.7.6.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.7.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.