@rigxyz/cli@0.14.7

Portable, runnable agent workspaces

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The automatic user-level agent skill setup creates a concrete lifecycle risk, so a warning is warranted. Its writes are scoped to the package-owned rig skill and include collision checks; inspected source does not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the npm package, unless RIG_SKIP_SKILL_INSTALL=1 is set.

Impact

The rig skill becomes available to agents in future sessions, changing their available instructions and CLI guidance.

Mechanism

The postinstall hook writes SKILL.md beneath the rig skill directory for existing Claude and shared agent harness directories, while preserving unrelated existing skills.

AI rationale

Evidence

package.jsonbin/postinstall.mjs~/.claude/skills/rig/SKILL.md~/.agents/skills/rig/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs bin/postinstall.mjs automatically after installation.
The hook writes a package-owned rig skill under existing user-level Claude and shared agent skill directories; it can be skipped with RIG_SKIP_SKILL_INSTALL=1.
The hook leaves an unrelated existing rig skill untouched, and the CLI also supports writing skills into a workspace’s agent skill directories.
The package’s default workspace include list covers .claude/** but limits .agents inclusion to .agents/skills/**.

Evidence against

No inspected source showed credential collection, exfiltration, remote payload execution, or broad agent configuration replacement.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

13 flagged

package.jsonView file

Lines 1-26json

2 "name": "@rigxyz/cli",

3 "version": "0.14.7",

4 "description": "Portable, runnable agent workspaces",

5 "type": "module",

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/*.test.mjs",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0",

23 "@rigxyz/tapd": "^0.6.0"

24 }

25}

src/mcp-readiness.mjsView file

Lines 1-36javascript

1// Whether each MCP server a rig declares in its .mcp.json is actually usable

2// by Claude in this folder: declared → approved → connected → exposes tools.

3//

4// Read through the host `claude` CLI (`claude mcp list`, run in the folder),

5// the same view Claude itself has. What that view does and doesn't say

6// (measured on Claude Code 2.1.283):

7// - An unapproved .mcp.json server shows "⏸ Pending approval" and isn't

8// connected to. (Headless `claude -p` / SDK runs load it anyway unless it's

9// in disabledMcpjsonServers; the Rig desktop app holds it back until you

10// click Allow, which records it in .claude/settings.local.json.)

src/cli.mjsView file

Lines 2350-2390javascript

2350 }

2351}

2352

2353async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2354 const statuses

src/collab.mjsView file

Lines 205-256javascript

205 return null;

206 } finally {

207 clearTimeout(timer);

208 }

209}

210

211let cachedTapdCmd = null;

bin/postinstall.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2//

3// Post-install hook for @rigxyz/cli.

4//

5// Writes the identical rig SKILL.md to every harness's global skill

6// convention this CLI knows about, so it's known in any folder, not just

7// inside an initialised rig workspace, regardless of which agent CLI is

8// reading:

9// - ~/.claude/skills/rig/SKILL.md (Claude Code)

10// - ~/.agents/skills/rig/SKILL.md (Codex, Amp, and other harnesses that

src/hub.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hub.mjs#virtual:normalized:round1View on unpkg

src/context.mjsView file

•matchType = normalized_sha256 matchedPackage = @rigxyz/cli@0.14.5 matchedPath = src/context.mjs matchedIdentity = npm:QHJpZ3h5ei9jbGk:0.14.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/context.mjsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/mcp-readiness.mjsView file

16L17: import { spawnSync } from "node:child_process"; L18: import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/mcp-readiness.mjsView on unpkg · L16

Findings

2 Critical9 High5 Medium5 Low

CriticalAi Agent Control Hijackbin/postinstall.mjs

CriticalPrevious Version Dangerous Deltasrc/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/mcp-readiness.mjs

HighShellsrc/cli.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/cli.mjs

HighRuntime Package Installsrc/collab.mjs

HighSemantic Analysis Limitedsrc/hub.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/collab.mjs

HighKnown Malware Source Similaritysrc/mcp-readiness.mjs

HighKnown Malware Source Similaritysrc/context.mjs

Affected versions and remediation

This report applies to @rigxyz/cli@0.14.7.

See all versions of @rigxyz/cli for other recorded verdicts.

Review the evidence and your use of @rigxyz/cli@0.14.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:04:58.612Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.