registry / @varveai/adit-cli / 1.0.14
@varveai/adit-cli@1.0.14
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall hook modifies global agent skill directories without an explicit user command. The files are ADIT's own skills and the installer avoids overwriting customized copies, so this is a warning-level agent extension lifecycle risk rather than a malicious attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook.
Impact
Agent environments may discover and use these instructions without the user explicitly running an ADIT setup command.
Mechanism
The hook imports `dist/install-skills.js`, which writes ADIT skill files under the user's `.agents/skills` and `.claude/skills` directories.
AI rationale
The postinstall hook modifies global agent skill directories without an explicit user command. The files are ADIT's own skills and the installer avoids overwriting customized copies, so this is a warning-level agent extension lifecycle risk rather than a malicious attack.
Evidence
package.jsoninstall-skill.cjsdist/install-skills.jsdist/commands/skills.js~/.agents/skills/adit-tasks/SKILL.md~/.agents/skills/adit-history/SKILL.md~/.agents/skills/adit-reports/SKILL.md~/.claude/skills/adit-tasks/SKILL.md~/.claude/skills/adit-history/SKILL.md~/.claude/skills/adit-reports/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package runs `node install-skill.cjs` from its postinstall hook.
- The hook imports and immediately runs the skill installer during package installation.
- The installer writes ADIT skills under the user's `.agents/skills` and `.claude/skills` directories.
- The installed files are specifically the `adit-tasks`, `adit-history`, and `adit-reports` skills.
Evidence against
- The install hook is limited to installing ADIT's own skills.
- The installer skips symbolic links and existing customized skills.
- No install-time network contact or credential collection was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/commands/self-update.jsView file
8*/
L9: import { execFileSync, execSync } from "node:child_process";
L10: import { existsSync, readFileSync, realpathSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/commands/self-update.jsView on unpkg · L8210console.log("Installing dependencies ...");
L211: execSync("pnpm install --frozen-lockfile", {
L212: ...showExecOpts,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/commands/self-update.jsFindings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/cli-agent/claude/hooks-bootstrap.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/commands/self-update.js
HighShelldist/commands/cli-agent/cli-process.js
HighRuntime Package Installdist/commands/self-update.js
MediumDynamic Requiredist/version.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @varveai/adit-cli@1.0.14.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.