registry / @varveai/adit-cli / 1.0.18
@varveai/adit-cli@1.0.18
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall hook automatically writes the package's own skills into user-level AI-agent directories without an explicit setup request. The installer limits writes to named ADIT skills and preserves customized copies, so this is a warning-level agent extension lifecycle risk rather than a demonstrated hijack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall.
Impact
AI agents may load these added instructions in future sessions without the user explicitly running a setup command.
Mechanism
The hook runs the bundled installer, which writes ADIT skill files under ~/.agents/skills and ~/.claude/skills.
AI rationale
The postinstall hook automatically writes the package's own skills into user-level AI-agent directories without an explicit setup request. The installer limits writes to named ADIT skills and preserves customized copies, so this is a warning-level agent extension lifecycle risk rather than a demonstrated hijack.
Evidence
package.jsoninstall-skill.cjsdist/install-skills.jsdist/commands/skills.js~/.agents/skills/adit-tasks/SKILL.md~/.agents/skills/adit-history/SKILL.md~/.agents/skills/adit-reports/SKILL.md~/.agents/skills/adit-memory/SKILL.md~/.claude/skills/adit-tasks/SKILL.md~/.claude/skills/adit-history/SKILL.md~/.claude/skills/adit-reports/SKILL.md~/.claude/skills/adit-memory/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The npm postinstall script runs install-skill.cjs, which imports and invokes the bundled skill installer.
- The installer writes ADIT skill files to the user's ~/.agents/skills and ~/.claude/skills directories.
- The skills are installed automatically outside the package directory, adding instructions to AI-agent skill directories.
- The installer skips existing customized skill files rather than overwriting them.
Evidence against
- The installed skills are named ADIT features, and the installer preserves customized copies.
- The reviewed CLI-agent hook server binds to 127.0.0.1.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/commands/self-update.jsView file
8*/
L9: import { execFileSync, execSync } from "node:child_process";
L10: import { existsSync, readFileSync, realpathSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/commands/self-update.jsView on unpkg · L8210console.log("Installing dependencies ...");
L211: execSync("pnpm install --frozen-lockfile", {
L212: ...showExecOpts,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/commands/self-update.jsFindings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/cli-agent/claude/hooks-bootstrap.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/commands/self-update.js
HighShelldist/commands/cli-agent/cli-process.js
HighRuntime Package Installdist/commands/self-update.js
MediumDynamic Requiredist/version.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @varveai/adit-cli@1.0.18.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.0.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.