registry / AI-agent control-surface risk / @xfive/chisel-ai-toolkit

@xfive/chisel-ai-toolkit

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

This report shows the evidence for @xfive/chisel-ai-toolkit@1.0.0. 1 of 8 known versions is blocked or flagged. The newest version, 1.7.1, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Although the installed content is package-aligned and no exfiltration or remote execution was found, the npm postinstall automatically installs behavior-bearing Claude Code configuration into the host project. That meets the blocking policy for unconsented install-time foreign AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation

Impact

Alters AI-agent behavior and blocks selected project write operations.

Mechanism

postinstall writes AI-agent rules, skills, and a Claude Code command hook

Policy narrative

Installing the package runs install.js automatically. The default emitters populate Claude and generic agent instruction files, copy skills and hook code into .claude, and register a PreToolUse command in .claude/settings.json. The registered hook intercepts editing tools and rejects writes under core/. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

Evidence

package.jsoninstall.jslib/emit.jslib/settings.jshooks/guard-core.jsCLAUDE.mdAGENTS.md.claude/settings.json.claude/chisel/hooks/guard-core.js.claude/skills/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs install.js via postinstall.
install.js defaults to Claude and AGENTS emitters during npm install.
lib/emit.js writes project CLAUDE.md, AGENTS.md, and .claude content.
lib/settings.js mutates .claude/settings.json to register a PreToolUse command hook.
hooks/guard-core.js is installed as that hook and blocks agent writes to core/.

Evidence against

No network clients, credential harvesting, remote payload loading, eval, or shell execution found.
The hook’s source only blocks writes under the project core/ directory.
verify.js invokes git status only for an explicit verification command.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 32.5 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 5-39json

5 "license": "MIT",

6 "type": "commonjs",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/xfiveco/chisel-ai-toolkit.git"

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "skills/",

16 "rules/",

17 "hooks/",

18 "lib/",

19 "install.js",

20 "uninstall.js",

21 "verify.js",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "install-toolkit": "node install.js",

27 "validate": "node scripts/validate-skills.js",

28 "verify": "node verify.js",

29 "prepublishOnly": "node scripts/validate-skills.js"

30 },

31 "bin": {

32 "chisel-ai-toolkit": "./install.js",

33 "chisel-verify": "./verify.js"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

4const path = require("node:path");

6const pkg = require("./package.json"

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_memory_files = new set(["claude.md", "agents.md"]); function stripmanagedblock(content) { const start = content.indexof(begin); const end = content.indexof(end); if (start === -1 || end === -1 || end < start) return content; return (content.slice(0, start) + content.slice(end + end.length)).replace(/\n{3,}/g, "\n\n").trimstart(); } function pruneemptydirs(di

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L17: const value = () => inline ?? argv[++i]; L18: if (flag === "--agent" || flag === "--agents") options.agents = value().split(","); L19: else if (flag === "--root") options.root = value(); ... L27: const roots = resolveRoots({ override: options.root }); L28: const agents = options.agents || DEFAULT_AGENTS; L29: Referenced control path from install.js: L17: const value = () => inline ?? argv[++i]; L18: if (flag === "--agent" || flag === "--agents") options.agents = value().split(","); L19: else if (flag === "--root") options.root = value(); ... L27: const roots = resolveRoots({ override: options.root }); L28: const agents = options.agents || DEFAULT_AGENTS; L29: Write operation

Findings

1 Critical2 High3 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationuninstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @xfive/chisel-ai-toolkit@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @xfive/chisel-ai-toolkit@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 23:06:47.893Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

1.7.1latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 3:43 PM 1.6.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 2:17 PM 1.5.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 12:25 PM 1.4.0SuspiciousAgent extension lifecycle riskWarnPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages