registry  /  @prnv/tuck  /  1.12.0

@prnv/tuck@1.12.0

Modern dotfiles manager with a beautiful CLI

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs tuck CLI commands such as `tuck mcp apply`, presets, apply/bootstrap, or MCP serve with write gate enabled.
Impact
May modify local agent/MCP config files by user command; no stealth install-time mutation or exfiltration confirmed.
Mechanism
explicit dotfile and AI-agent configuration management
Rationale
Mark warn rather than block because agent config mutation is real but explicit, package-aligned, and guarded/prompted rather than unconsented install-time control-surface hijacking. Scanner credential/exfiltration hints appear to come from local secret-management and GitHub token validation code, not malicious exfiltration.
Evidence
package.jsondist/index.jsREADME.mdtemplates/presets/agent-everything/preset.jsontemplates/presets/claude-code/preset.jsontemplates/devcontainer/install.sh~/.claude/CLAUDE.md~/.claude/settings.json~/.config/mcp/mcp.json~/.cursor/mcp.json~/.mcp.json.mcp.jsonmcp.json.vscode/mcp.json
Network endpoints3
api.github.com/usergithub.com/Pranav-Karra-3301/tucktuck.sh

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • dist/index.js exposes `tuck mcp apply` that writes rendered MCP server definitions into Claude/Cursor/VS Code-style client config paths after explicit command/confirmation or `--yes`.
  • dist/index.js includes `tuck mcp serve`; only `context_add` is write-gated by TUCK_MCP_ALLOW_WRITE, but it can track AI agent config files when enabled.
  • templates/presets/agent-everything/preset.json and claude-code preset target `~/.claude/CLAUDE.md`, `~/.claude/settings.json`, Cursor/Aider/MCP config templates.
Evidence against
  • package.json has no preinstall/install/postinstall; prepare is `husky install` and prepublishOnly is build-only.
  • AI-agent and dotfile writes are package-aligned and activated by explicit tuck commands/presets, not install-time mutation.
  • MCP apply prompts before writing in interactive mode, supports dry-run, and backs up existing client config files.
  • Secret handling scans/extracts/redacts local config values; no confirmed credential exfiltration found.
  • Network use is package-aligned: GitHub API token validation, git remotes, update-notifier, and documented install/help URLs.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 1.12 MB of source, external domains: 1password.com, api.github.com, bitwarden.com, cli.github.com, docs.github.com, docs.gitlab.com, git-scm.com, git.example.com, github.com, githubstatus.com, gitlab.com, rtyley.github.io, start.1password.com, vault.example.com, www.passwordstore.org

Source & flagged code

10 flagged · loading source
dist/index.jsView file
7149patternName = private_key_rsa severity = critical line = 7149 matchedText = pattern:...-/g,
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L7149
201${colors.muted("Run")} ${colors.brand("tuck <command> --help")} ${colors.muted("for details")} L202: ${colors.muted("Docs:")} ${colors.brand("https://github.com/Pranav-Karra-3301/tuck")} L203: `; ... L272: hasEmitted = true; L273: process.stdout.write(JSON.stringify(env) + "\n"); L274: }; ... L331: if (isJsonMode()) return; L332: if (process.env.DEBUG) { L333: console.log(colors.muted(figures2.bullet), colors.muted(msg)); ... L428: PermissionError: () => PermissionError, L429: PrivateKeyError: () => PrivateKeyError, L430: ReadOnlyViolationError: () => ReadOnlyViolationError,
Critical
Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L201
201Trigger-reachable chain: manifest.main -> dist/index.js L201: ${colors.muted("Run")} ${colors.brand("tuck <command> --help")} ${colors.muted("for details")} L202: ${colors.muted("Docs:")} ${colors.brand("https://github.com/Pranav-Karra-3301/tuck")} L203: `; ... L272: hasEmitted = true; L273: process.stdout.write(JSON.stringify(env) + "\n"); L274: }; ... L331: if (isJsonMode()) return; L332: if (process.env.DEBUG) { L333: console.log(colors.muted(figures2.bullet), colors.muted(msg)); ... L428: PermissionError: () => PermissionError, L429: PrivateKeyError: () => PrivateKeyError, L430: ReadOnlyViolationError: () => ReadOnlyViolationError,
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L201
7149patternName = private_key_rsa severity = critical line = 7149 matchedText = pattern:...-/g,
Critical
Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L7149
7506patternName = private_key_rsa severity = critical line = 7506 matchedText = pattern:...-/g,
Critical
Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L7506
7514patternName = private_key_openssh severity = critical line = 7514 matchedText = pattern:...-/g,
Critical
Secret Pattern

OpenSSH private key in dist/index.js

dist/index.jsView on unpkg · L7514
7530patternName = private_key_ec severity = critical line = 7530 matchedText = pattern:...-/g,
Critical
Secret Pattern

EC private key in dist/index.js

dist/index.jsView on unpkg · L7530
7538patternName = private_key_rsa severity = critical line = 7538 matchedText = pattern:...-/g,
Critical
Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L7538
201${colors.muted("Run")} ${colors.brand("tuck <command> --help")} ${colors.muted("for details")} L202: ${colors.muted("Docs:")} ${colors.brand("https://github.com/Pranav-Karra-3301/tuck")} L203: `; ... L272: hasEmitted = true; L273: process.stdout.write(JSON.stringify(env) + "\n"); L274: }; ... L331: if (isJsonMode()) return; L332: if (process.env.DEBUG) { L333: console.log(colors.muted(figures2.bullet), colors.muted(msg)); ... L428: PermissionError: () => PermissionError, L429: PrivateKeyError: () => PrivateKeyError, L430: ReadOnlyViolationError: () => ReadOnlyViolationError,
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L201
templates/devcontainer/install.shView file
•path = templates/devcontainer/install.sh kind = build_helper sizeBytes = 1333 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/devcontainer/install.shView on unpkg

Findings

8 Critical5 Medium5 Low
CriticalCritical Secretdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalSecret Patterndist/index.js
CriticalSecret Patterndist/index.js
CriticalSecret Patterndist/index.js
CriticalSecret Patterndist/index.js
CriticalSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helpertemplates/devcontainer/install.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings