Loading npm security reports…

@rigxyz/cli@0.13.0: AI-agent control-surface risk | LPM Firewall

registry / @rigxyz/cli / 0.13.0

@rigxyz/cli@0.13.0

Portable, runnable agent workspaces

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies existing global AI-agent skill directories. It installs behavior-bearing instructions that activate across broad user requests and authorize shell commands.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install runs the postinstall hook.

Impact

Existing Claude and shared agent harnesses can load package-authored instructions and command permissions outside a project workspace.

Mechanism

Global AI-agent skill injection through postinstall.

Policy narrative

The manifest invokes bin/postinstall.mjs during installation. That code detects existing .claude and .agents home directories, creates skills/rig directories, and writes a user-level SKILL.md. The payload instructs multiple agent harnesses to trigger on broad workspace and review requests, including when the user never mentions rig, while allowing shell execution of rig and tapd. This is unconsented install-time mutation of a foreign, broad AI-agent control surface.

Rationale

The automatic postinstall hook writes a globally loaded, behavior-bearing agent skill into multiple existing harnesses. Its broad trigger rules and shell permissions make this a concrete AI-agent control-surface hijack.

Evidence

package.jsonbin/postinstall.mjs.claude/skills/rig/SKILL.md.agents/skills/rig/SKILL.md

Decision evidence

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/collab.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rigxyz/cli@0.8.0 matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.8.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/collab.mjsView on unpkg

15import * as p from "@clack/prompts"; L16: import { spawn, spawnSync } from "node:child_process"; L17: import { createRequire } from "node:module";

High

Child Process

Package source references child process execution.

src/collab.mjsView on unpkg · L15

236const { cmd, prefix } = tapdCmd(); L237: const res = spawnSync(cmd, [...prefix, "--version"], { encoding: "utf8" }); L238: if (res.error?.code === "ENOENT") { ... L240: `rig's sync engine (tapd) is missing. Reinstalling rig fixes it:\n` + L241: ` npm install -g @rigxyz/cli@latest\n` + L242: `(Developers: set RIG_TAPD_BIN to point at a local build.)`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/collab.mjsView on unpkg · L236

225try { L226: const require = createRequire(import.meta.url); L227: const binPath = require.resolve("@rigxyz/tapd/dist/bin.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/collab.mjsView on unpkg · L225

src/cli.mjsView file

2244cwd, L2245: shell: true, L2246: encoding: "utf8"

High

Shell

Package source references shell execution.

src/cli.mjsView on unpkg · L2244

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. servepermissions(config, cwd) { if (!config.allowpermissions.length && !config.denypermissions.length) return []; const settingspath = path.join(cwd, ".claude", "settings.json"); let settings = {}; try { settings = json.parse(await readfile(settingspath, "utf8")); } catch (error) { if (error.code !== "enoent") throw error; } const currentallow = array.isarray(settings.permissions?.allow) ? settings.permissions.allow : []; const currentdeny = array.isarray(settings.permissions?.deny) ? settings.permissions.deny : []; const missingallow = config.allowpermissions.filter((p) => !currentallow.includes(p) && !currentdeny.includes(p)); const missingdeny = co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/cli.mjsView on unpkg

bin/postinstall.mjsView file

8// reading: L9: // - ~/.claude/skills/rig/SKILL.md (Claude Code) L10: // - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that L11: // follow the shared .agents/skills L12: // convention — same SKILL.md format, ... L17: // Behaviour, independently per harness directory: L18: // - Silent no-op if the harness's home dir (~/.claude or ~/.agents) L19: // doesn't exist (user isn't on that harness; don't create the dir ... L26: // - Native copies, not symlinks or a dependency on a sk[redacted] L27: // CLI (evidenced on dev machines by a separate ~/.agents/.sk[redacted] L28: // some such tool owns) — `rig install` must stay hermetic/offline, and a ... L34:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L8

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/files.mjsView file

•matchType = token_shingles matchedPackage = @rigxyz/cli@0.12.0 matchedPath = src/files.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.12.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/files.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-26json

1{

2 "name": "@rigxyz/cli",

3 "version": "0.13.0",

4 "description": "Portable, runnable agent workspaces",

5 "type": "module",

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/*.test.mjs",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0",

23 "@rigxyz/tapd": "^0.6.0"

24 }

25}

26

src/collab.mjsView file

Lines 1-35javascript

1// rig <-> tap integration.

2//

3// Rig shells out to the `tapd` CLI and parses its versioned --json contract

4// (protocolVersion: 1). It never imports tapd as a library or touches the

5// state DB directly — with one exception: `rig attach` (see loadTapdLib()

6// below), which has no invite secret to hand a CLI verb and so reuses

7// tapd's writeBindingConfig/openStateDb primitives directly. See

8// ~/code/tap/rig-tap-integration-plan.md.

9//

10// Auth: rig owns identity. `rig login` writes a Clerk JWT to

src/cli.mjsView file

Lines 2224-2264javascript

2224 }

2225}

2226

2227async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2228 const statuses

bin/postinstall.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2//

3// Post-install hook for @rigxyz/cli.

4//

5// Writes the identical rig SKILL.md to every harness's global skill

6// convention this CLI knows about, so it's known in any folder, not just

7// inside an initialised rig workspace, regardless of which agent CLI is

8// reading:

9// - ~/.claude/skills/rig/SKILL.md (Claude Code)

10// - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/files.mjsView file

•matchType = token_shingles matchedPackage = @rigxyz/cli@0.12.0 matchedPath = src/files.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.12.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/files.mjsView on unpkg

Lines 205-256javascript

205 return null;

206 } finally {

207 clearTimeout(timer);

208 }

209}

210

211let cachedTapdCmd = null;

212

213/**

214 * How to invoke tapd: { cmd, prefix } — spawn as `cmd [...prefix, ...args]`.

215 * Precedence: RIG_TAPD_BIN (dev override, spawned directly) → the bundled

216 * @rigxyz/tapd dependency (run via the current node, guaranteed version-

217 * compatible) → bare `tapd` on PATH (pre-bundling global installs).

218 */

219export function tapdCmd() {

220 if (cachedTapdCmd) return cachedTapdCmd;

221 if (process.env.RIG_TAPD_BIN) {

222 cachedTapdCmd = { cmd: process.env.RIG_TAPD_BIN, prefix: [] };

223 return cachedTapdCmd;

224 }

225 try {

226 const require = createRequire(import.meta.url);

227 const binPath = require.resolve("@rigxyz/tapd/dist/bin.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/collab.mjsView on unpkg · L225

228 cachedTapdCmd = { cmd: process.execPath, prefix: [binPath] };

229 } catch {

230 cachedTapdCmd = { cmd: "tapd", prefix: [] };

231 }

232 return cachedTapdCmd;

233}

234

235export function checkTapd({ minVersion = MIN_TAPD_VERSION } = {}) {

236 const { cmd, prefix } = tapdCmd();

237 const res = spawnSync(cmd, [...prefix, "--version"], { encoding: "utf8" });

238 if (res.error?.code === "ENOENT") {

239 throw new RigCollabError(

240 `rig's sync engine (tapd) is missing. Reinstalling rig fixes it:\n` +

241 ` npm install -g @rigxyz/cli@latest\n` +

242 `(Developers: set RIG_TAPD_BIN to point at a local build.)`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/collab.mjsView on unpkg · L236

243 );

244 }

245 if (res.status !== 0) {

246 throw new RigCollabError(`tapd --version failed (exit ${res.status}): ${(res.stderr || res.stdout).trim()}`);

247 }

248 const version = res.stdout.trim();

249 if (!/^\d+\.\d+\.\d+/.test(version)) {

250 throw new RigCollabError(`tapd --version returned unparseable output: "${version}"`);

251 }

252 if (compareSemver(version, minVersion) < 0) {

253 throw new RigCollabError(

254 `tapd ${version} is too old; rig requires >=${minVersion}.\n` +

255 `Update with: npm install -g @rigxyz/tapd`,

256 );