@slopus/rig@0.0.6

Opinionated pi fork with strong defaults for coding-agent workflows.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct inspection shows a package-aligned, explicitly invoked coding-agent CLI rather than install-time or covert attack behavior. Scanner hits are explained by legitimate clipboard integration, local daemon setup, provider requests, and bundled web assets.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the rig CLI or invokes its agent tools.

Impact

User-authorized agent actions may access configured credentials, clipboard images, local session state, and requested web resources; no stealth install-time execution or exfiltration chain was found.

Mechanism

Explicit coding-agent runtime operations with local state and provider requests.

AI rationale

Evidence

package.jsondist/main.jsdist/app/main.jsdist/app/readClipboardImage.jsdist/providers/requestAnthropicMessage.jsdist/tools/claude/webFetch/isPreapprovedWebFetchUrl.jsdist/tools/claude/webFetch/getWithPermittedRedirects.jsdist/web/assets/index-D5rSlaXz.jsdist/client/ensureLocalProtocolServer.jsdist/server/LocalServerPaths.jsdist/server/writeLocalServerToken.js

Network endpoints2

api.anthropic.com/v1/messages?beta=trueapi.anthropic.com/api/web/domain_info

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
dist/main.js only invokes the CLI application after explicit execution.
dist/app/readClipboardImage.js reads clipboard images on demand and writes them to a rig temp directory; no network use.
dist/providers/requestAnthropicMessage.js sends authenticated model requests only to configured Anthropic API endpoints.
dist/tools/claude/webFetch/ restricts redirect handling and uses user-invoked web tooling.
The flagged Unicode in dist/web/assets/index-D5rSlaXz.js is bundled UI/library text, not concealed executable control flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Source & flagged code

3 flagged

dist/app/readClipboardImage.jsView file

Lines 50-90javascript

50 for (const mimeType of tryTypes) {

51 const data = runCommand("xclip", ["-selection", "clipboard", "-t", mimeType, "-o"]);

52 if (data.ok && data.stdout.length > 0) {

53 return { bytes: data.stdout, mediaType: baseMimeType(mimeType) };

54 }

55 }

56 return undefined;

57}

58async function readClipboardImageViaNativeClipboard() {

59 const clipboard = loadClipboardModule();

60 if (clipboard === undefined || !clipboard.hasImage()) {

61 return undefined;

62 }

63 const imageData = await clipboard.getImageBinary();

64 if (imageData.length === 0) {

65 return undefined;

66 }

67 return { bytes: Buffer.from(imageData), mediaType: "image/png" };

68}

69function loadClipboardModule() {

70 try {

71 const require = createRequire(import.meta.url);

72 return require("@mariozechner/clipboard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/readClipboardImage.jsView on unpkg · L70

73 }

74 catch {

75 return undefined;

76 }

77}

78function writeClipboardImageFile(image, outputDirectory) {

79 const directory = outputDirectory ?? join(tmpdir(), "rig-clipboard-images");

80 mkdirSync(directory, { recursive: true });

81 const path = join(directory, `rig-clipboard-${randomUUID()}.${extensionForMimeType(image.mediaType)}`);

82 writeFileSync(path, image.bytes);

83 return path;

84}

85function extensionForMimeType(mimeType) {

86 switch (baseMimeType(mimeType)) {

87 case "image/jpeg":

88 return "jpg";

89 case "image/webp":

90 return "webp";

dist/tools/utils/prepareImageForClaude.jsView file

Lines 1-25javascript

1import { createHash } from "node:crypto";

2import { LRUCache } from "lru-cache";

3import { getImageProcessor } from "./getImageProcessor.js";

4import { ImageProcessingError } from "./ImageProcessingError.js"

dist/web/assets/index-D5rSlaXz.jsView file

86contains invisible/control Unicode U+200B (zero width space) `).at(-1);if(o&&o.trim().length>0)return`${e}<U+200B>`}if(xH.test(i)&&!n.match(TH)){let o=r.split(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-D5rSlaXz.jsView on unpkg · L86

Source & flagged code

3 flagged · loading source

dist/app/readClipboardImage.jsView file

70try { L71: const require = createRequire(import.meta.url); L72: return require("@mariozechner/clipboard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/readClipboardImage.jsView on unpkg · L70

dist/tools/utils/prepareImageForClaude.jsView file

5import { MAX_PROMPT_IMAGE_INPUT_BYTES, } from "./prepareImageForPrompt.js"; L6: export const CLAUDE_IMAGE_MAX_BASE64_BYTES = 5 * 1024 * 1024; L7: export const CLAUDE_IMAGE_MAX_RAW_BYTES = (CLAUDE_IMAGE_MAX_BASE64_BYTES * 3) / 4;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/utils/prepareImageForClaude.jsView on unpkg · L5

dist/web/assets/index-D5rSlaXz.jsView file

Findings

1 Critical4 Medium6 Low

CriticalTrojan Source Unicodedist/web/assets/index-D5rSlaXz.js

MediumDynamic Requiredist/app/readClipboardImage.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/tools/utils/prepareImageForClaude.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @slopus/rig@0.0.6.

See all versions of @slopus/rig for other recorded verdicts.

Review the evidence and your use of @slopus/rig@0.0.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-11 04:51:40.514Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.