@oked/claude-code@0.6.3
OKed for Claude Code - zero-code human approval for sensitive actions
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection shows a user-invoked command that modifies Claude Code project settings and installs a hook matching broad tool actions. This is a warning-level agent capability, with no evidence of unconsented install-time mutation or credential exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs `oked init`.
Impact
The hook can mediate Claude Code tool actions through the OKed approval flow.
Mechanism
The CLI writes or updates the project’s `.claude/settings.json` to invoke `oked-hook` for matching actions.
AI rationale
Source inspection shows a user-invoked command that modifies Claude Code project settings and installs a hook matching broad tool actions. This is a warning-level agent capability, with no evidence of unconsented install-time mutation or credential exfiltration.
Evidence
dist/cli.jsdist/hook-config.js.claude/settings.json
Network endpoints1
api.oked.ai
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes the `oked` CLI and has no npm install lifecycle hook.
- Running `oked init` adds or updates an OKed command hook in the project’s Claude settings.
- The hook matches Bash, file editing, agent, and MCP tool actions.
- Pairing sends a device-code request to the configured OKed backend and saves the returned key after pairing.
Evidence against
- The settings change is performed by the explicit `init` command, not by an npm install hook.
- Pairing uses the package’s OKed backend and requires the user to complete device approval.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
High
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
...
L10: import { OKED_RECEIPTS_LOG, verifyReceiptsFile } from "./receipts.js";
L11: const DEFAULT_BACKEND_URL = process.env.OKED_BACKEND_URL || "https://api.oked.ai";
L12: function getSettingsPath() {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L44import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
...
L10: import { OKED_RECEIPTS_LOG, verifyReceiptsFile } from "./receipts.js";
L11: const DEFAULT_BACKEND_URL = process.env.OKED_BACKEND_URL || "https://api.oked.ai";
L12: function getSettingsPath() {
L13: return join(process.cwd(), ".claude", "settings.json");
L14: }
...
L18: try {
L19: return JSON.parse(readFileSync(path, "utf-8"));
L20: }
...
L45: function openBrowser(url) {
Findings
3 High5 Medium4 Low
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/cli.js
MediumAi Review Evidencedist/cli.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @oked/claude-code@0.6.3.
See all versions of @oked/claude-code for other recorded verdicts.
- Review the evidence and your use of @oked/claude-code@0.6.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.