registry / @oked/claude-code / 0.6.5
@oked/claude-code@0.6.5
OKed for Claude Code - zero-code human approval for sensitive actions
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no npm install lifecycle hook, and the inspected settings changes are initiated by `oked init`. User-level changes are limited to upgrading an existing OKed hook, so no attack surface was established.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `oked init`.
Impact
The hook can apply across projects when already configured in user-level settings; inspection found no unconsented install-time mutation or other confirmed attack.
Mechanism
The CLI installs or updates the OKed hook in project settings and may upgrade an existing OKed hook in user-level settings.
AI rationale
The manifest has no npm install lifecycle hook, and the inspected settings changes are initiated by `oked init`. User-level changes are limited to upgrading an existing OKed hook, so no attack surface was established.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists `prepublishOnly` as `npm run build`; no install lifecycle hook is present in its scripts.
- The CLI targets the current project’s `.claude/settings.json`; its hook configuration describes writes and upgrades through `oked init`.
- The CLI adds a hook to project settings when none exists, as part of `init`.
- User-level settings upgrades leave files without an existing `oked-hook` entry unchanged.
Evidence against
- Running `oked init` can update an existing `oked-hook` entry in user-level Claude settings, affecting all projects.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
High
4import { join, dirname } from "path";
L5: import { spawn } from "child_process";
L6: import { createInterface } from "readline";
...
L10: import { OKED_RECEIPTS_LOG, verifyReceiptsFile } from "./receipts.js";
L11: const DEFAULT_BACKEND_URL = process.env.OKED_BACKEND_URL || "https://api.oked.ai";
L12: /** `oked init --key-only`: create or show the API key; add or change no hook. */
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L4•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { readfilesync, writefilesync, existssync, mkdirsync, chmodsync } from "fs";
import { hostname } from "os";
import { join, dirname } from "path";
import { spawn } from "child_process";
import { createinterface } from "readline";
import { okedclient, loadokedconfig, oked_config_path } from "@oked/sdk";
import { hook_config, hasokedcommandhook, ensuremcpmatcher, ensurehooktimeout, upgradesettingsfile, usersettingspath, } from "./hook-config.js";
import { client_version } from "./version.js";
import { oked_receipts_log, verifyreceiptsfile } from "./receipts.js";
const default_backend_url = process.env.oked_backend_url || "https://api.oked.ai";
Findings
4 High2 Medium6 Low
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cli.js
Affected versions and remediation
This report applies to @oked/claude-code@0.6.5.
See all versions of @oked/claude-code for other recorded verdicts.
- Review the evidence and your use of @oked/claude-code@0.6.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.