registry / @varveai/adit-cli / 1.1.9
@varveai/adit-cli@1.1.9
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 23h ago · by lpm-firewall-aiThe postinstall hook makes ADIT's own skills available to user-level AI agents without a separate setup request, which fits the warning-only agent extension lifecycle risk. The reviewed installer preserves customized skills and does not show broader agent configuration edits or credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package outside CI and without root privileges.
Impact
The skills become available to AI agents without a separate user setup command; this is an automatic install-time agent extension setup.
Mechanism
The lifecycle script invokes the setup entry, which writes ADIT skill files into the user's agent skill directories and starts the daemon.
AI rationale
The postinstall hook makes ADIT's own skills available to user-level AI agents without a separate setup request, which fits the warning-only agent extension lifecycle risk. The reviewed installer preserves customized skills and does not show broader agent configuration edits or credential exfiltration.
Evidence
package.jsoninstall-skill.cjsdist/installation.jsdist/commands/skills.js~/.agents/skills/<ADIT skill>/SKILL.md~/.agents/skills/<ADIT skill>/.adit-managed.json~/.claude/skills/<ADIT skill>/SKILL.md~/.claude/skills/<ADIT skill>/.adit-managed.json
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package declares a postinstall script that runs install-skill.cjs.
- For published installs, that script runs the setup entry with --open-browser.
- Setup installs ADIT skills into the user-level ~/.agents/skills and ~/.claude/skills directories.
- The same automatic setup starts the local background service.
Evidence against
- The setup installs the package's own named ADIT skills, not general agent settings or hooks.
- Existing customized skill files and symlinks are skipped rather than overwritten.
- The reviewed setup flow showed no credential forwarding or unrelated collector endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/local/auto-update-process.jsView file
1import { spawn } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/local/auto-update-process.jsView on unpkg · L1dist/commands/cli-agent/cli-process.jsView file
80* Terminate a spawned CLI, including its descendants on Windows. `.cmd`/`.bat`
L81: * shims run under a cmd.exe shell, so killing only the direct child leaves the
L82: * real CLI (e.g. claude.exe) alive and still reading the console — which is
Findings
2 Critical7 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/main.js
CriticalPrevious Version Dangerous Deltadist/local/daemon.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/local/auto-update-process.js
HighShelldist/commands/cli-agent/cli-process.js
HighCommand Output Exfiltrationdist/commands/pr.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/pr.js
HighRuntime Package Installdist/commands/self-update.js
HighSemantic Analysis Limiteddist/local/attribution-evidence.js#virtual:normalized:round1
MediumDynamic Requiredist/version.js
MediumNetwork
Affected versions and remediation
This report applies to @varveai/adit-cli@1.1.9.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.