Loading npm security reports…

@rigxyz/cli@0.14.3: AI-agent control-surface risk | LPM Firewall

registry / @rigxyz/cli / 0.14.3

@rigxyz/cli@0.14.3

Portable, runnable agent workspaces

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically adds behavior-bearing skills to user-level Claude and shared agent directories. These instructions can affect agent behavior beyond the package installation directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation with postinstall enabled, an existing .claude or .agents directory, and no environment opt-out.

Impact

Foreign AI agents receive persistent instructions and expanded activation conditions for workspace tasks.

Mechanism

The hook resolves the user's home, creates the rig skill directory, and writes embedded instructions without requesting consent.

Policy narrative

The npm postinstall hook writes embedded skills into existing user-level Claude and shared agent directories. The resulting instructions activate for workspace review and discussion even when rig is not named. Collision protection and an environment opt-out limit some writes but do not establish consent to modifying these foreign agent control surfaces.

AI rationale

Inspected executable source establishes unconsented postinstall mutation of foreign user-level AI-agent control surfaces, which meets the explicit blocking policy. This conclusion does not rely on scanner similarity labels or assumed credential theft.

Evidence

package.jsonbin/postinstall.mjs~/.claude/skills/rig/SKILL.md~/.agents/skills/rig/SKILL.md

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/mcp-readiness.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rigxyz/cli@0.14.2 matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.2 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mcp-readiness.mjsView on unpkg

16L17: import { spawnSync } from "node:child_process"; L18: import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/mcp-readiness.mjsView on unpkg · L16

src/cli.mjsView file

2338cwd, L2339: shell: true, L2340: encoding: "utf8"

High

Shell

Package source references shell execution.

src/cli.mjsView on unpkg · L2338

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. servepermissions(config, cwd) { if (!config.allowpermissions.length && !config.denypermissions.length) return []; const settingspath = path.join(cwd, ".claude", "settings.json"); let settings = {}; try { settings = json.parse(await readfile(settingspath, "utf8")); } catch (error) { if (error.code !== "enoent") throw error; } const currentallow = array.isarray(settings.permissions?.allow) ? settings.permissions.allow : []; const currentdeny = array.isarray(settings.permissions?.deny) ? settings.permissions.deny : []; const missingallow = config.allowpermissions.filter((p) => !currentallow.includes(p) && !currentdeny.includes(p)); const missingdeny = co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/cli.mjsView on unpkg

src/collab.mjsView file

236const { cmd, prefix } = tapdCmd(); L237: const res = spawnSync(cmd, [...prefix, "--version"], { encoding: "utf8" }); L238: if (res.error?.code === "ENOENT") { ... L240: `rig's sync engine (tapd) is missing. Reinstalling rig fixes it:\n` + L241: ` npm install -g @rigxyz/cli@latest\n` + L242: `(Developers: set RIG_TAPD_BIN to point at a local build.)`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/collab.mjsView on unpkg · L236

•matchType = token_shingles matchedPackage = @rigxyz/cli@0.13.0 matchedPath = src/collab.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.13.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/collab.mjsView on unpkg

225try { L226: const require = createRequire(import.meta.url); L227: const binPath = require.resolve("@rigxyz/tapd/dist/bin.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/collab.mjsView on unpkg · L225

bin/postinstall.mjsView file

8// reading: L9: // - ~/.claude/skills/rig/SKILL.md (Claude Code) L10: // - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that L11: // follow the shared .agents/skills L12: // convention — same SKILL.md format, ... L17: // Behaviour, independently per harness directory: L18: // - Silent no-op if the harness's home dir (~/.claude or ~/.agents) L19: // doesn't exist (user isn't on that harness; don't create the dir ... L26: // - Native copies, not symlinks or a dependency on a sk[redacted] L27: // CLI (evidenced on dev machines by a separate ~/.agents/.sk[redacted] L28: // some such tool owns) — `rig install` must stay hermetic/offline, and a ... L34:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L8

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/files.mjsView file

•matchType = token_shingles matchedPackage = @rigxyz/cli@0.13.0 matchedPath = src/files.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.13.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/files.mjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-26json

1{

2 "name": "@rigxyz/cli",

3 "version": "0.14.3",

4 "description": "Portable, runnable agent workspaces",

5 "type": "module",

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/*.test.mjs",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0",

23 "@rigxyz/tapd": "^0.6.0"

24 }

25}

26

src/mcp-readiness.mjsView file

Lines 1-36javascript

1// Whether each MCP server a rig declares in its .mcp.json is actually usable

2// by Claude in this folder: declared → approved → connected → exposes tools.

3//

4// Read through the host `claude` CLI (`claude mcp list`, run in the folder),

5// the same view Claude itself has. What that view does and doesn't say

6// (measured on Claude Code 2.1.283):

7// - An unapproved .mcp.json server shows "⏸ Pending approval" and isn't

8// connected to. (Headless `claude -p` / SDK runs load it anyway unless it's

9// in disabledMcpjsonServers; the Rig desktop app holds it back until you

10// click Allow, which records it in .claude/settings.local.json.)

src/cli.mjsView file

Lines 2318-2358javascript

2318 }

2319}

2320

2321async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2322 const statuses

src/collab.mjsView file

Lines 205-256javascript

205 return null;

206 } finally {

207 clearTimeout(timer);

208 }

209}

210

211let cachedTapdCmd = null;

bin/postinstall.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2//

3// Post-install hook for @rigxyz/cli.

4//

5// Writes the identical rig SKILL.md to every harness's global skill

6// convention this CLI knows about, so it's known in any folder, not just

7// inside an initialised rig workspace, regardless of which agent CLI is

8// reading:

9// - ~/.claude/skills/rig/SKILL.md (Claude Code)

10// - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/files.mjsView file

•matchType = token_shingles matchedPackage = @rigxyz/cli@0.13.0 matchedPath = src/files.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.13.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/files.mjsView on unpkg