@rigxyz/cli@0.14.1

Portable, runnable agent workspaces

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The lifecycle hook creates a package-owned agent skill in global harness locations, which warrants a non-blocking warning under the agent-extension policy. The inspected relay code restricts credential forwarding to recognised or explicitly user-allowed hosts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm runs postinstall unless the opt-out variable is set.

Impact

The installed skill can influence supported agent harnesses outside the project directory, creating a guarded extension lifecycle risk.

Mechanism

The hook iterates existing .claude and .agents directories beneath the home root, creates skills/rig, and writes SKILL.md.

AI rationale

Evidence

package.jsonbin/postinstall.mjs~/.claude/skills/rig/SKILL.md~/.agents/skills/rig/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an automatic postinstall hook.
The hook runs for each existing .claude and .agents directory under the selected home root.
The hook creates a rig skill directory and writes SKILL.md there.
Relay credentials are rejected for unrecognised relay hosts unless the user explicitly allows them.

Evidence against

The postinstall hook has an opt-out environment variable and avoids creating absent harness roots.
No source evidence established secret harvesting, destructive behavior, or remote payload execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 17 file(s), 361 KB of source, external domains: 127.0.0.1, api.github.com, docs.astral.sh, hub.userig.workers.dev, tap-relay.fly.dev, userig.xyz

Source & flagged code

12 flagged

package.jsonView file

Lines 1-26json

2 "name": "@rigxyz/cli",

3 "version": "0.14.1",

4 "description": "Portable, runnable agent workspaces",

5 "type": "module",

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/*.test.mjs",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0",

23 "@rigxyz/tapd": "^0.6.0"

24 }

25}

src/collab.mjsView file

Lines 1-35javascript

1// rig <-> tap integration.

2//

3// Rig shells out to the `tapd` CLI and parses its versioned --json contract

4// (protocolVersion: 1). It never imports tapd as a library or touches the

5// state DB directly — with one exception: `rig attach` (see loadTapdLib()

6// below), which has no invite secret to hand a CLI verb and so reuses

7// tapd's writeBindingConfig/openStateDb primitives directly. See

8// ~/code/tap/rig-tap-integration-plan.md.

9//

10// Auth: rig owns identity. `rig login` writes a Clerk JWT to

src/cli.mjsView file

Lines 2272-2312javascript

2272 }

2273}

2274

2275async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2276 const statuses

bin/postinstall.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2//

3// Post-install hook for @rigxyz/cli.

4//

5// Writes the identical rig SKILL.md to every harness's global skill

6// convention this CLI knows about, so it's known in any folder, not just

7// inside an initialised rig workspace, regardless of which agent CLI is

8// reading:

9// - ~/.claude/skills/rig/SKILL.md (Claude Code)

10// - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/files.mjsView file

•matchType = token_shingles matchedPackage = @rigxyz/cli@0.13.0 matchedPath = src/files.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.13.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/files.mjsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/collab.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rigxyz/cli@0.8.0 matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.8.0 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/collab.mjsView on unpkg

Findings

2 Critical8 High5 Medium5 Low

CriticalAi Agent Control Hijackbin/postinstall.mjs

CriticalPrevious Version Dangerous Deltasrc/collab.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/collab.mjs

HighShellsrc/cli.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/cli.mjs

HighRuntime Package Installsrc/collab.mjs

HighSemantic Analysis Limitedsrc/hub.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/collab.mjs

HighKnown Malware Source Similaritysrc/files.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

Medium

Affected versions and remediation

This report applies to @rigxyz/cli@0.14.1.

See all versions of @rigxyz/cli for other recorded verdicts.

Review the evidence and your use of @rigxyz/cli@0.14.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:09:12.832Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.