registry / @ngockhoale/ukit / 3.4.13
@ngockhoale/ukit@3.4.13
⚠ Under reviewInstall/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected source supports benign workspace tooling and did not establish an independent attack risk. A clean verdict requires citations for eleven distinct paths, exceeding the eight-citation limit, so this review remains unresolved.
Static reason
No blocking static signals were detected.
Trigger
No malicious trigger identified; the package command runs when invoked by a user.
Impact
No confirmed attack surface was established from the cited excerpts.
Mechanism
The inspected code exposes a CLI, probes or manages workspace configuration, and creates benchmark fixtures.
AI rationale
The inspected source supports benign workspace tooling and did not establish an independent attack risk. A clean verdict requires citations for eleven distinct paths, exceeding the eight-citation limit, so this review remains unresolved.
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a command-line entry point and declares no install lifecycle hook.
- The benchmark target creates a temporary fixture project and writes a package manifest.
- The performance audit target is a measurement tool for hook behavior.
- The Codex probe inventories an installed workspace’s configuration surface.
- The plan applier protects agent configuration paths from writes.
- The Git ignore helper manages entries for the package’s workspace files.
- The gateway resilience helper preserves existing agent settings.
- The hook repair helper examines Claude settings files.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcescripts/bench/runGold.mjsView file
121const rootDir = projectRoot ?? REPO_ROOT;
L122: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L123: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L121src/core/memory/learningCandidates.jsView file
1// learningCandidates.js — M04.2 learning candidates (SPEC §5 FR-016, FR-018; C11).
L2: //
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/memory/learningCandidates.jsView on unpkg · L1template_project/.claude/hooks/task-watchdog.shView file
Findings
2 High4 Medium6 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/audit/decision-coverage.mjs#virtual:normalized:round1
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplate_project/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/memory/learningCandidates.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.13.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@3.4.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.