registry / @rigxyz/cli / 0.12.0

@rigxyz/cli@0.12.0

Portable, runnable agent workspaces

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates global Claude and shared .agents skill directories when they already exist. The dropped skill directs agent behavior broadly and grants shell access to rig and tapd commands.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install executes postinstall.

Impact

Unconsented persistent modification of foreign AI-agent control surfaces.

Mechanism

Install-time global AI-agent skill deployment.

Policy narrative

Installing the package runs bin/postinstall.mjs. When ~/.claude or ~/.agents exists, it creates skills/rig/SKILL.md and writes a behavior-bearing agent skill. This occurs without an explicit rig command and affects global agent behavior outside a project workspace; the skill includes broad trigger instructions and permits shell commands.

Rationale

Direct source inspection confirms an unconsented postinstall write to global AI-agent skill locations. Collision checks reduce overwrite risk but do not remove the foreign control-surface mutation.

Evidence

package.jsonbin/postinstall.mjs~/.claude/skills/rig/SKILL.md~/.agents/skills/rig/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with false-positive risk.

low

Evidence for policy risk

npm postinstall executes bin/postinstall.mjs.
Postinstall writes a generated SKILL.md into existing ~/.claude and ~/.agents agent-control directories.
Installed skill has broad automatic trigger guidance and Bash access to rig/tapd commands.

Evidence against

Hook does not create absent harness home directories.
It avoids overwriting an unrelated existing rig skill.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 15 file(s), 305 KB of source, external domains: 127.0.0.1, api.github.com, docs.astral.sh, hub.userig.workers.dev, tap-relay.fly.dev, userig.xyz

Source & flagged code

9 flagged

package.jsonView file

Lines 1-26json

1{

2 "name": "@rigxyz/cli",

3 "version": "0.12.0",

4 "description": "Portable, runnable agent workspaces",

5 "type":

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/collab.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rigxyz/cli@0.8.0 matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.8.0 similarity = 0.643 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/collab.mjsView on unpkg

Findings

2 Critical5 High5 Medium5 Low

CriticalAi Agent Control Hijackbin/postinstall.mjs

CriticalPrevious Version Dangerous Deltasrc/collab.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/collab.mjs

HighShellsrc/cli.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/files.mjs

HighRuntime Package Installsrc/collab.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/collab.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LPM CLI

15import * as p from "@clack/prompts"; L16: import { spawn, spawnSync } from "node:child_process"; L17: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

src/collab.mjsView on unpkg · L15

244const { cmd, prefix } = tapdCmd(); L245: const res = spawnSync(cmd, [...prefix, "--version"], { encoding: "utf8" }); L246: if (res.error?.code === "ENOENT") { ... L248: `rig's sync engine (tapd) is missing. Reinstalling rig fixes it:\n` + L249: ` npm install -g @rigxyz/cli@latest\n` + L250: `(Developers: set RIG_TAPD_BIN to point at a local build.)`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/collab.mjsView on unpkg · L244

233try { L234: const require = createRequire(import.meta.url); L235: const binPath = require.resolve("@rigxyz/tapd/dist/bin.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/collab.mjsView on unpkg · L233

src/cli.mjsView file

2235cwd, L2236: shell: true, L2237: encoding: "utf8"

High

Shell

Package source references shell execution.

src/cli.mjsView on unpkg · L2235

bin/postinstall.mjsView file

8// reading: L9: // - ~/.claude/skills/rig/SKILL.md (Claude Code) L10: // - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that L11: // follow the shared .agents/skills L12: // convention — same SKILL.md format, ... L17: // Behaviour, independently per harness directory: L18: // - Silent no-op if the harness's home dir (~/.claude or ~/.agents) L19: // doesn't exist (user isn't on that harness; don't create the dir ... L26: // - Native copies, not symlinks or a dependency on a sk[redacted] L27: // CLI (evidenced on dev machines by a separate ~/.agents/.sk[redacted] L28: // some such tool owns) — `rig install` must stay hermetic/offline, and a ... L32:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L8

src/files.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. on sha256file(file) { const hash = createhash("sha256"); hash.update(await readfile(file)); return hash.digest("hex"); } export async function readinstancetoml(cwd) { const source = await readfile(path.join(cwd, ".rig", "instance.toml"), "utf8"); return parsetoml(source); } export async function writeinstancemetadata({ targetdir, manifest, source, registry, previousversion }) { const installedat = new date().toisostring(); const sourcelines = [ "[source]", `name = "${manifest.rig.name}"`, `author = "${manifest.rig.author}"`, `version = "${manifest.rig.version}"`, `registry = "${registry || "artifact"}"`, `ref = "${source}"`, `installed

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/files.mjsView on unpkg

Low

Filesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Network

Shell

HighEntropyStrings

UrlStrings

NoLicense

Source & flagged code

9 flagged

package.jsonView file

Lines 1-26json

1{

2 "name": "@rigxyz/cli",

3 "version": "0.12.0",

4 "description": "Portable, runnable agent workspaces",

5 "type":

"module"

,

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0",

23 "@rigxyz/tapd": "^0.6.0"

24 }

25}

26

src/collab.mjsView file

Lines 1-35javascript

1// rig <-> tap integration.

2//

3// Rig shells out to the `tapd` CLI and parses its versioned --json contract

4// (protocolVersion: 1). It never imports tapd as a library or touches the

5// state DB directly — with one exception: `rig attach` (see loadTapdLib()

6// below), which has no invite secret to hand a CLI verb and so reuses

7// tapd's writeBindingConfig/openStateDb primitives directly. See

8// ~/code/tap/rig-tap-integration-plan.md.

9//

10// Auth: rig owns identity. `rig login` writes a Clerk JWT to

src/cli.mjsView file

Lines 2215-2255javascript

2215 }

2216}

2217

2218async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2219 const statuses

bin/postinstall.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2//

3// Post-install hook for @rigxyz/cli.

4//

5// Writes the identical rig SKILL.md to every harness's global skill

6// convention this CLI knows about, so it's known in any folder, not just

7// inside an initialised rig workspace, regardless of which agent CLI is

8// reading:

9// - ~/.claude/skills/rig/SKILL.md (Claude Code)

10// - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that

src/files.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. on sha256file(file) { const hash = createhash("sha256"); hash.update(await readfile(file)); return hash.digest("hex"); } export async function readinstancetoml(cwd) { const source = await readfile(path.join(cwd, ".rig", "instance.toml"), "utf8"); return parsetoml(source); } export async function writeinstancemetadata({ targetdir, manifest, source, registry, previousversion }) { const installedat = new date().toisostring(); const sourcelines = [ "[source]", `name = "${manifest.rig.name}"`, `author = "${manifest.rig.author}"`, `version = "${manifest.rig.version}"`, `registry = "${registry || "artifact"}"`, `ref = "${source}"`, `installed

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/files.mjsView on unpkg

11// ~/.config/rig/config.json as `hub_token`. We pass that JWT through

12// to tapd via RIG_HUB_TOKEN env on the two commands that need user

13// identity (init, join). Other tapd commands use the per-binding

14// capability token in .rig/tap-binding.local.json and don't need it.

15import * as p from "@clack/prompts";

16import { spawn, spawnSync } from "node:child_process";

17import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

src/collab.mjsView on unpkg · L15

18import { closeSync, existsSync, openSync } from "node:fs";

19import { mkdir, readFile } from "node:fs/promises";

20import path from "node:path";

21import { setTimeout as delay } from "node:timers/promises";

22import { getRelayToken, getRelayUrl } from "./config.mjs";

23import { buildAnchor, groupThreads, reanchor, shortenQuote } from "./comment-anchors.mjs";

24

25// 0.6.0 is the first tapd build that accepts `tapd init --org <slug>`

26// (org-scoped bindings). 0.5.3 is published WITHOUT --org and silently

27// drops the flag — the floor must be strictly above it.

28const MIN_TAPD_VERSION = "0.6.0";

29// The hosted relay is the default so a fresh `rig share`/`rig sync` works out

30// of the box. Point at a local relay for development with RIG_RELAY (e.g.

31// RIG_RELAY=http://127.0.0.1:4030), or per-workspace via [sync].relay / --relay.

32const DEFAULT_RELAY = process.env.RIG_RELAY || "https://tap-relay.fly.dev";

33

34export class RigCollabError extends Error {

35 constructor(message) { super(message); this.name = "RigCollabError"; }

Lines 213-264javascript

213 .replace(/[^a-z0-9]+/g, "-")

214 .replace(/^-+|-+$/g, "")

215 .slice(

•matchType = previous_version_dangerous_delta matchedPackage = @rigxyz/cli@0.8.0 matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.8.0 similarity = 0.643 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/collab.mjsView on unpkg

=

[];

2220 if (!config.installCommands.length) return statuses;

2221 let shouldRun = runHooks;

2222 if (!shouldRun && interactive && !yes) {

2223 p.note(config.installCommands.join("\n"), "Install commands");

2224 shouldRun = await promptConfirm({

2225 message: "Run install commands now?",

2226 initialValue: false

2227 });

2228 }

2229 for (const command of config.installCommands) {

2230 if (!shouldRun) {

2231 statuses.push({ command, status: "skipped" });

2232 continue;

2233 }

2234 const result = spawnSync(command, {

2235 cwd,

2236 shell: true,

2237 encoding: "utf8"

High

Shell

Package source references shell execution.

src/cli.mjsView on unpkg · L2235

2238 });

2239 statuses.push({

2240 command,

2241 status: result.status === 0 ? "ok" : "failed",

2242 exitCode: result.status,

2243 stderr: result.stderr?.trim() || ""

2244 });

2245 }

2246 return statuses;

2247}

2248

2249function printSetupResult(result, { interactive = false } = {}) {

2250 const lines = [

2251 `Local dirs: ${result.localDirs.length ? result.localDirs.join(", ") : "none"}`,

2252 `Env file: ${result.envResult.targetPath || "none"}`,

2253 "Agent skill: wrote .claude/skills/rig/SKILL.md and .agents/skills/rig/SKILL.md",

2254 `Claude awareness: ${result.claudeAwareness?.status || "unknown"} ${result.claudeAwareness?.path || ".claude/CLAUDE.md"}`,

2255 `Agents brief: ${result.agentsBrief?.status || "unknown"} ${result.agentsBrief?.path || "AGENTS.md"}`,

11

// follow the shared .agents/skills

12// convention — same SKILL.md format,

13// verified against this convention's

14// real entries: name/description

15// frontmatter + markdown body)

16//

17// Behaviour, independently per harness directory:

18// - Silent no-op if the harness's home dir (~/.claude or ~/.agents)

19// doesn't exist (user isn't on that harness; don't create the dir

20// behind their back).

21// - Collision-safe: if SKILL.md already exists there and isn't one of

22// ours (no "managed by @rigxyz/cli" marker), leave it alone and warn —

23// never clobber an unrelated skill that happens to be named "rig".

24// - Idempotent: skip-write when the installed file already matches the

25// current SKILL_VERSION marker.

26// - Native copies, not symlinks or a dependency on a skills-management

27// CLI (evidenced on dev machines by a separate ~/.agents/.skill-lock.json

28// some such tool owns) — `rig install` must stay hermetic/offline, and a

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L8

0

,

60

);

216 return slug || "shared-rig";

217}

218

219let cachedTapdCmd = null;

220

221/**

222 * How to invoke tapd: { cmd, prefix } — spawn as `cmd [...prefix, ...args]`.

223 * Precedence: RIG_TAPD_BIN (dev override, spawned directly) → the bundled

224 * @rigxyz/tapd dependency (run via the current node, guaranteed version-

225 * compatible) → bare `tapd` on PATH (pre-bundling global installs).

226 */

227export function tapdCmd() {

228 if (cachedTapdCmd) return cachedTapdCmd;

229 if (process.env.RIG_TAPD_BIN) {

230 cachedTapdCmd = { cmd: process.env.RIG_TAPD_BIN, prefix: [] };

231 return cachedTapdCmd;

232 }

233 try {

234 const require = createRequire(import.meta.url);

235 const binPath = require.resolve("@rigxyz/tapd/dist/bin.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/collab.mjsView on unpkg · L233

236 cachedTapdCmd = { cmd: process.execPath, prefix: [binPath] };

237 } catch {

238 cachedTapdCmd = { cmd: "tapd", prefix: [] };

239 }

240 return cachedTapdCmd;

241}

242

243export function checkTapd({ minVersion = MIN_TAPD_VERSION } = {}) {

244 const { cmd, prefix } = tapdCmd();

245 const res = spawnSync(cmd, [...prefix, "--version"], { encoding: "utf8" });

246 if (res.error?.code === "ENOENT") {

247 throw new RigCollabError(

248 `rig's sync engine (tapd) is missing. Reinstalling rig fixes it:\n` +

249 ` npm install -g @rigxyz/cli@latest\n` +

250 `(Developers: set RIG_TAPD_BIN to point at a local build.)`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/collab.mjsView on unpkg · L244

251 );

252 }

253 if (res.status !== 0) {

254 throw new RigCollabError(`tapd --version failed (exit ${res.status}): ${(res.stderr || res.stdout).trim()}`);

255 }

256 const version = res.stdout.trim();

257 if (!/^\d+\.\d+\.\d+/.test(version)) {

258 throw new RigCollabError(`tapd --version returned unparseable output: "${version}"`);

259 }

260 if (compareSemver(version, minVersion) < 0) {

261 throw new RigCollabError(

262 `tapd ${version} is too old; rig requires >=${minVersion}.\n` +

263 `Update with: npm install -g @rigxyz/tapd`,

264 );