registry / @varveai/adit-cli / 1.1.2
@varveai/adit-cli@1.1.2
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall setup automatically places ADIT's own skills in user-level AI-agent directories, which warrants a warning under the install-time agent-extension rule. The reviewed path does not establish credential theft or another concrete malicious action.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A regular non-CI, non-root package installation runs the postinstall setup.
Impact
Agents may load the installed skills in later sessions without a separate explicit skill-install command.
Mechanism
The setup writes ADIT skill files under the user's .agents/skills and .claude/skills directories, making them available to agents.
AI rationale
The postinstall setup automatically places ADIT's own skills in user-level AI-agent directories, which warrants a warning under the install-time agent-extension rule. The reviewed path does not establish credential theft or another concrete malicious action.
Evidence
package.jsoninstall-skill.cjsdist/install-skills.jsdist/installation.jsdist/commands/skills.js~/.agents/skills/<skill>/SKILL.md~/.agents/skills/<skill>/.adit-managed.json~/.claude/skills/<skill>/SKILL.md~/.claude/skills/<skill>/.adit-managed.json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package runs install-skill.cjs from postinstall; for regular installs, that script launches setup with --open-browser.
- Setup installs ADIT skills into the user's ~/.agents/skills and ~/.claude/skills directories during postinstall.
- The installed skills are available to AI agents after setup, so this is automatic install-time agent extension setup.
Evidence against
- The installer skips setup in CI and refuses to perform it as root.
- Existing customized skill files are preserved unless their contents match ADIT's recorded managed version.
- I found no install-time credential exfiltration or unrelated account actions in the reviewed setup path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/local/attribution-analysis.jsView file
1import { createHash, randomUUID } from "node:crypto";
L2: import { execFile } from "node:child_process";
L3: import { promisify } from "node:util";
High
Child Process
Package source references child process execution.
dist/local/attribution-analysis.jsView on unpkg · L1dist/commands/cli-agent/cli-process.jsView file
80
Findings
1 Critical7 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/main.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/local/attribution-analysis.js
HighShelldist/commands/cli-agent/cli-process.js
HighCommand Output Exfiltrationdist/commands/pr.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/pr.js
HighRuntime Package Installdist/commands/self-update.js
HighSemantic Analysis Limiteddist/local/attribution-evidence.js#virtual:normalized:round1
MediumDynamic Requiredist/version.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @varveai/adit-cli@1.1.2.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.