@slopus/rig@0.0.7

Opinionated pi fork with strong defaults for coding-agent workflows.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The flagged primitives are consistent with an explicitly invoked coding-agent CLI: provider authentication, clipboard image attachment, sandboxed shell execution, and local configuration/trust storage. Inspection found no lifecycle execution or concrete chain that exfiltrates data, installs persistence, or mutates foreign agent controls.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Explicit `rig` CLI execution and user-selected agent/tool actions.

Impact

Can access model credentials and perform approved agent operations, but no unconsented install-time or stealth behavior was found.

Mechanism

User-invoked coding-agent runtime with provider API access and guarded local tools.

AI rationale

Evidence

package.jsondist/main.jsdist/app/readClipboardImage.jsdist/providers/readClaudeCodeOAuthToken.jsdist/agent/context/assertCanReadPath.jsdist/config/createProjectConfigSecurityNotice.jsdist/mcp/createProjectMcpSecurityNotice.jsdist/agent/context/assertCanWritePath.jsdist/mcp/McpTrustStore.js

Network endpoints2

api.anthropic.com/api/web/domain_infochatgpt.com/backend-api

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

`dist/app/readClipboardImage.js` reads clipboard images only during runtime and writes them to a rig temp directory.
`dist/providers/readClaudeCodeOAuthToken.js` reads a Claude OAuth token for the selected provider.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`dist/main.js` runs only when the `rig` CLI is explicitly invoked.
`dist/agent/context/assertCanReadPath.js` blocks sensitive files outside the workspace in restricted modes.
`dist/config/createProjectConfigSecurityNotice.js` ignores project-requested permission escalation.
`dist/mcp/createProjectMcpSecurityNotice.js` requires one-time trust for project MCP servers.
No source evidence of stealth exfiltration, remote payload execution, destructive actions, or foreign AI-agent config mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Source & flagged code

4 flagged

dist/app/readClipboardImage.jsView file

Lines 50-90javascript

50 for (const mimeType of tryTypes) {

51 const data = runCommand("xclip", ["-selection", "clipboard", "-t", mimeType, "-o"]);

52 if (data.ok && data.stdout.length > 0) {

53 return { bytes: data.stdout, mediaType: baseMimeType(mimeType) };

54 }

55 }

56 return undefined;

57}

58async function readClipboardImageViaNativeClipboard() {

59 const clipboard = loadClipboardModule();

60 if (clipboard === undefined || !clipboard.hasImage()) {

61 return undefined;

62 }

63 const imageData = await clipboard.getImageBinary();

64 if (imageData.length === 0) {

65 return undefined;

66 }

67 return { bytes: Buffer.from(imageData), mediaType: "image/png" };

68}

69function loadClipboardModule() {

70 try {

71 const require = createRequire(import.meta.url);

72 return require("@mariozechner/clipboard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/readClipboardImage.jsView on unpkg · L70

73 }

74 catch {

75 return undefined;

76 }

77}

78function writeClipboardImageFile(image, outputDirectory) {

79 const directory = outputDirectory ?? join(tmpdir(), "rig-clipboard-images");

80 mkdirSync(directory, { recursive: true });

81 const path = join(directory, `rig-clipboard-${randomUUID()}.${extensionForMimeType(image.mediaType)}`);

82 writeFileSync(path, image.bytes);

83 return path;

84}

85function extensionForMimeType(mimeType) {

86 switch (baseMimeType(mimeType)) {

87 case "image/jpeg":

88 return "jpg";

89 case "image/webp":

90 return "webp";

dist/tools/utils/prepareImageForClaude.jsView file

Lines 1-25javascript

1import { createHash } from "node:crypto";

2import { LRUCache } from "lru-cache";

3import { getImageProcessor } from "./getImageProcessor.js";

4import { ImageProcessingError } from "./ImageProcessingError.js"

dist/web/assets/index-BDRnr8TE.jsView file

86contains invisible/control Unicode U+200B (zero width space) `).at(-1);if(o&&o.trim().length>0)return`${e}<U+200B>`}if(OH.test(i)&&!n.match(LH)){let o=r.split(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-BDRnr8TE.jsView on unpkg · L86

dist/app/runExec.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @slopus/rig@0.0.6 matchedIdentity = npm:QHNsb3B1cy9yaWc:0.0.6 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app/runExec.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/app/readClipboardImage.jsView file

70try { L71: const require = createRequire(import.meta.url); L72: return require("@mariozechner/clipboard");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/readClipboardImage.jsView on unpkg · L70

dist/tools/utils/prepareImageForClaude.jsView file

5import { MAX_PROMPT_IMAGE_INPUT_BYTES, } from "./prepareImageForPrompt.js"; L6: export const CLAUDE_IMAGE_MAX_BASE64_BYTES = 5 * 1024 * 1024; L7: export const CLAUDE_IMAGE_MAX_RAW_BYTES = (CLAUDE_IMAGE_MAX_BASE64_BYTES * 3) / 4;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/utils/prepareImageForClaude.jsView on unpkg · L5

dist/web/assets/index-BDRnr8TE.jsView file

Findings

1 Critical1 High4 Medium6 Low

CriticalTrojan Source Unicodedist/web/assets/index-BDRnr8TE.js

HighPrevious Version Dangerous Deltadist/app/runExec.js

MediumDynamic Requiredist/app/readClipboardImage.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/tools/utils/prepareImageForClaude.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @slopus/rig@0.0.7.

See all versions of @slopus/rig for other recorded verdicts.

Review the evidence and your use of @slopus/rig@0.0.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-12 06:34:51.296Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.