registry / AI-agent capability abuse / @slopus/rig / 0.0.15

@slopus/rig@0.0.15

Opinionated pi fork with strong defaults for coding-agent workflows.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The scanner's malicious classification is not supported by the inspected source. The package is a high-capability, explicitly invoked agent CLI, so it warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the `rig` CLI and enables or prompts agent tools.

Impact

A user who grants full access may allow agent-driven shell, filesystem, network, and credential-backed provider actions; source shows permission guards for restricted modes.

Mechanism

User-invoked local coding-agent execution with configurable provider and MCP transports.

AI rationale

The scanner's malicious classification is not supported by the inspected source. The package is a high-capability, explicitly invoked agent CLI, so it warrants a warning rather than a block.

Evidence

package.jsondist/main.jsdist/client/ensureLocalProtocolServer.jsdist/providers/readClaudeCodeOAuthToken.jsdist/agent/context/assertCanReadPath.jsdist/agent/context/assertCanWritePath.jsdist/agent/context/createNodeBashContext.jsdist/app/readClipboardImage.jsdist/mcp/McpTrustStore.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/providers/readClaudeCodeOAuthToken.js` reads Claude OAuth credentials for provider authentication.
`dist/agent/context/createNodeBashContext.js` exposes shell execution to the coding-agent runtime.
`dist/tools/claude/WebFetch.js` permits user/agent-requested HTTPS fetches.
`dist/app/readClipboardImage.js` reads clipboard images only when its feature is invoked.
`dist/client/ensureLocalProtocolServer.js` starts a detached local daemon and writes a local token.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
`dist/main.js` only starts after explicit `rig` CLI invocation.
`dist/agent/context/assertCanReadPath.js` blocks sensitive external reads outside full-access mode.
`dist/agent/context/assertCanWritePath.js` confines non-full-access writes to the workspace.
`dist/mcp/McpTrustStore.js` stores only Rig-owned MCP trust decisions under its config path.
No source evidence of hard-coded exfiltration endpoint, remote payload loading, or foreign AI-agent config mutation.

Behavioral surface

Source

Source & flagged code

4 flagged

dist/app/readClipboardImage.jsView file

Lines 50-90javascript

50 for (const mimeType of tryTypes) {

51 const data = runCommand("xclip", ["-selection", "clipboard", "-t", mimeType, "-o"]);

52 if (data.ok && data.stdout.length > 0) {

53 return { bytes: data.stdout, mediaType: baseMimeType(mimeType) };

54 }

55 }

56 return undefined;

57}

58async function readClipboardImageViaNativeClipboard() {

59 const clipboard = loadClipboardModule();

60 if (clipboard === undefined || !clipboard.hasImage()) {

61 return undefined;

62 }

63 const imageData = await clipboard.getImageBinary();

64 if (imageData.length === 0) {

65 return undefined;

66 }

67 return { bytes: Buffer.from(imageData), mediaType: "image/png" };

68}

69function loadClipboardModule() {

70 try {

71 const require = createRequire(import.meta.url);

72 return require("@mariozechner/clipboard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/readClipboardImage.jsView on unpkg · L70

73 }

74 catch {

75 return undefined;

76 }

77}

78function writeClipboardImageFile(image, outputDirectory) {

79 const directory = outputDirectory ?? join(tmpdir(), "rig-clipboard-images");

80 mkdirSync(directory, { recursive: true });

81 const path = join(directory, `rig-clipboard-${randomUUID()}.${extensionForMimeType(image.mediaType)}`);

82 writeFileSync(path, image.bytes);

83 return path;

84}

85function extensionForMimeType(mimeType) {

86 switch (baseMimeType(mimeType)) {

87 case "image/jpeg":

88 return "jpg";

89 case "image/webp":

90 return "webp";

dist/tools/utils/prepareImageForClaude.jsView file

Lines 1-25javascript

1import { createHash } from "node:crypto";

2import { LRUCache } from "lru-cache";

3import { getImageProcessor } from "./getImageProcessor.js";

4import { ImageProcessingError } from "./ImageProcessingError.js"

dist/web/assets/index-BDRnr8TE.jsView file

86contains invisible/control Unicode U+200B (zero width space) `).at(-1);if(o&&o.trim().length>0)return`${e}<U+200B>`}if(OH.test(i)&&!n.match(LH)){let o=r.split(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-BDRnr8TE.jsView on unpkg · L86

dist/app/runExec.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @slopus/rig@0.0.7 matchedIdentity = npm:QHNsb3B1cy9yaWc:0.0.7 similarity = 0.575 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app/runExec.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/app/readClipboardImage.jsView file

70try { L71: const require = createRequire(import.meta.url); L72: return require("@mariozechner/clipboard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/readClipboardImage.jsView on unpkg · L70

dist/tools/utils/prepareImageForClaude.jsView file

5import { MAX_PROMPT_IMAGE_INPUT_BYTES, } from "./prepareImageForPrompt.js"; L6: export const CLAUDE_IMAGE_MAX_BASE64_BYTES = 5 * 1024 * 1024; L7: export const CLAUDE_IMAGE_MAX_RAW_BYTES = (CLAUDE_IMAGE_MAX_BASE64_BYTES * 3) / 4;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/utils/prepareImageForClaude.jsView on unpkg · L5

dist/web/assets/index-BDRnr8TE.jsView file

Findings

1 Critical1 High4 Medium6 Low

CriticalTrojan Source Unicodedist/web/assets/index-BDRnr8TE.js

HighPrevious Version Dangerous Deltadist/app/runExec.js

MediumDynamic Requiredist/app/readClipboardImage.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/tools/utils/prepareImageForClaude.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @slopus/rig@0.0.15.

See all versions of @slopus/rig for other recorded verdicts.

Review the evidence and your use of @slopus/rig@0.0.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-15 23:02:11.454Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.