@raditia/craftkit@1.49.0
AI coding skills that auto-sync across Claude Code, Cursor, Gemini CLI, and Codex CLI
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe postinstall automatically configures CraftKit's own agent extensions, including hooks in global agent settings, which warrants a warning under the first-party extension lifecycle policy. Inspected source did not establish a concrete malicious behavior or unrelated control-surface mutation.
Decision evidence
public snapshot- The npm postinstall automatically invokes scripts/postinstall.sh, which sets AGENTIC_SETUP and runs sync.sh.
- The setup pass installs CraftKit hooks and other package-owned agent extensions across Claude, Cursor, Gemini, and Codex adapters.
- The Claude adapter adds CraftKit hook entries to the user's global settings file and writes the modified settings back.
- The observed setup is for CraftKit's own named extensions and managed files; no unrelated control surface mutation or malicious payload was identified.
- The reviewed hook sources showed local input processing and filesystem reads without an observed network exfiltration path.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe npm postinstall automatically invokes scripts/postinstall.sh, which sets AGENTIC_SETUP and runs sync.sh.
package.jsonView on unpkg · L6Findings
Affected versions and remediation
This report applies to @raditia/craftkit@1.49.0.
See all versions of @raditia/craftkit for other recorded verdicts.
- Review the evidence and your use of @raditia/craftkit@1.49.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.