@ngockhoale/ukit@3.3.3
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package has no npm lifecycle hook, and the flagged shell helper is limited to selected Claude hook events. Its package-owned agent integration and automatic session-triggered learning support a warning under the stated policy, while the inspected evidence does not support blocking.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the UKit CLI to install the workspace integration; configured agent hooks and session events can later activate its behavior.
Impact
The integration can run package-owned code during agent workflows and perform automatic learning or tuning; inspected evidence does not show unauthorized credential disclosure or destructive effects.
Mechanism
Claude settings register the watchdog hook, which filters for specific hook events; the package also describes a detached self-improvement cycle triggered by agent session events.
AI rationale
The package has no npm lifecycle hook, and the flagged shell helper is limited to selected Claude hook events. Its package-owned agent integration and automatic session-triggered learning support a warning under the stated policy, while the inspected evidence does not support blocking.
Evidence
template_project/.claude/settings.jsontemplate_project/.claude/hooks/task-watchdog.shsrc/learning/selfImprove.js
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes UKit through a CLI and declares no npm lifecycle hook, so the reviewed integration is not activated by npm installation.
- The shipped Claude settings register task-watchdog.sh as a hook, and its code processes only Stop or PostToolUse events.
- selfImprove.js describes a detached automatic collect, learn, and apply cycle triggered from agent session events.
Evidence against
- The watchdog ignores unrelated hook events and delegates Stop handling to a project-local coordinator.
- The inspected code indicates an agent workspace integration; it does not establish credential theft, destructive behavior, or an unrelated network recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcescripts/bench/runGold.mjsView file
121const rootDir = projectRoot ?? REPO_ROOT;
L122: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L123: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L121src/core/memory/learningCandidates.jsView file
1// learningCandidates.js — M04.2 learning candidates (SPEC §5 FR-016, FR-018; C11).
L2: //
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/memory/learningCandidates.jsView on unpkg · L1template_project/.claude/hooks/task-watchdog.shView file
Findings
2 High5 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/audit/decision-coverage.mjs#virtual:normalized:round1
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplate_project/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowWeak Cryptosrc/core/memory/learningCandidates.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.3.3.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@3.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.