Loading npm security reports…

@rigxyz/cli@0.14.5: AI-agent control-surface risk | LPM Firewall

registry / @rigxyz/cli / 0.14.5

@rigxyz/cli@0.14.5

Portable, runnable agent workspaces

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook writes a package-provided Rig skill into global agent skill directories. This changes agent instructions during installation without a separate user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm, unless RIG_SKIP_SKILL_INSTALL is set to 1.

Impact

The skill becomes available to agents across folders and can influence their behavior beyond the package workspace.

Mechanism

The hook targets the user's .claude and .agents directories, creates skills/rig, and writes SKILL.md containing Rig guidance.

Policy narrative

During npm installation, the postinstall hook writes a Rig skill under the user's global Claude and shared .agents skill directories. The skill supplies agent-facing instructions and is available beyond the project that installed the package. Although the installer has a skip flag and collision checks, the default behavior mutates global agent instruction surfaces without a separate setup command.

AI rationale

The package automatically mutates global AI-agent instruction directories during postinstall, creating an unconsented agent control surface. This matches the install-hook blocking policy despite the installer’s collision protections and skip flag.

Evidence

package.jsonbin/postinstall.mjs

Decision evidence

public snapshot

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/mcp-readiness.mjsView file

16L17: import { spawnSync } from "node:child_process"; L18: import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/mcp-readiness.mjsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = @rigxyz/cli@0.14.4 matchedPath = src/mcp-readiness.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-readiness.mjsView on unpkg

src/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rigxyz/cli@0.14.2 matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.2 similarity = 0.765 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.mjsView on unpkg

2372cwd, L2373: shell: true, L2374: encoding: "utf8"

High

Shell

Package source references shell execution.

src/cli.mjsView on unpkg · L2372

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. servepermissions(config, cwd) { if (!config.allowpermissions.length && !config.denypermissions.length) return []; const settingspath = path.join(cwd, ".claude", "settings.json"); let settings = {}; try { settings = json.parse(await readfile(settingspath, "utf8")); } catch (error) { if (error.code !== "enoent") throw error; } const currentallow = array.isarray(settings.permissions?.allow) ? settings.permissions.allow : []; const currentdeny = array.isarray(settings.permissions?.deny) ? settings.permissions.deny : []; const missingallow = config.allowpermissions.filter((p) => !currentallow.includes(p) && !currentdeny.includes(p)); const missingdeny = co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/collab.mjsView file

236const { cmd, prefix } = tapdCmd(); L237: const res = spawnSync(cmd, [...prefix, "--version"], { encoding: "utf8" }); L238: if (res.error?.code === "ENOENT") { ... L240: `rig's sync engine (tapd) is missing. Reinstalling rig fixes it:\n` + L241: ` npm install -g @rigxyz/cli@latest\n` + L242: `(Developers: set RIG_TAPD_BIN to point at a local build.)`,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/collab.mjsView on unpkg · L236

•matchType = normalized_sha256 matchedPackage = @rigxyz/cli@0.14.4 matchedPath = src/collab.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/collab.mjsView on unpkg

225try { L226: const require = createRequire(import.meta.url); L227: const binPath = require.resolve("@rigxyz/tapd/dist/bin.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/collab.mjsView on unpkg · L225

bin/postinstall.mjsView file

8// reading: L9: // - ~/.claude/skills/rig/SKILL.md (Claude Code) L10: // - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that L11: // follow the shared .agents/skills L12: // convention — same SKILL.md format, ... L17: // Behaviour, independently per harness directory: L18: // - Silent no-op if the harness's home dir (~/.claude or ~/.agents) L19: // doesn't exist (user isn't on that harness; don't create the dir ... L26: // - Native copies, not symlinks or a dependency on a sk[redacted] L27: // CLI (evidenced on dev machines by a separate ~/.agents/.sk[redacted] L28: // some such tool owns) — `rig install` must stay hermetic/offline, and a ... L34:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L8

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/context.mjsView file

•matchType = normalized_sha256 matchedPackage = @rigxyz/cli@0.14.4 matchedPath = src/context.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/context.mjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-26json

1{

2 "name": "@rigxyz/cli",

3 "version": "0.14.5",

4 "description": "Portable, runnable agent workspaces",

5 "type": "module",

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/*.test.mjs",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0",

23 "@rigxyz/tapd": "^0.6.0"

24 }

25}

26

src/mcp-readiness.mjsView file

Lines 1-36javascript

1// Whether each MCP server a rig declares in its .mcp.json is actually usable

2// by Claude in this folder: declared → approved → connected → exposes tools.

3//

4// Read through the host `claude` CLI (`claude mcp list`, run in the folder),

5// the same view Claude itself has. What that view does and doesn't say

6// (measured on Claude Code 2.1.283):

7// - An unapproved .mcp.json server shows "⏸ Pending approval" and isn't

8// connected to. (Headless `claude -p` / SDK runs load it anyway unless it's

9// in disabledMcpjsonServers; the Rig desktop app holds it back until you

10// click Allow, which records it in .claude/settings.local.json.)

src/cli.mjsView file

Lines 2352-2392javascript

2352 }

2353}

2354

2355async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2356 const statuses

src/collab.mjsView file

Lines 205-256javascript

205 return null;

206 } finally {

207 clearTimeout(timer);

208 }

209}

210

211let cachedTapdCmd = null;

bin/postinstall.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2//

3// Post-install hook for @rigxyz/cli.

4//

5// Writes the identical rig SKILL.md to every harness's global skill

6// convention this CLI knows about, so it's known in any folder, not just

7// inside an initialised rig workspace, regardless of which agent CLI is

8// reading:

9// - ~/.claude/skills/rig/SKILL.md (Claude Code)

10// - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/context.mjsView file

•matchType = normalized_sha256 matchedPackage = @rigxyz/cli@0.14.4 matchedPath = src/context.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/context.mjsView on unpkg