Loading npm security reports…

@xfive/chisel-ai-toolkit@1.0.0: AI-agent control-surface risk | LPM Firewall

registry / @xfive/chisel-ai-toolkit / 1.0.0

@xfive/chisel-ai-toolkit@1.0.0

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The postinstall lifecycle script automatically mutates a project's Claude Code configuration and general agent instructions. It installs a behavior-bearing PreToolUse hook without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation

Impact

Alters AI-agent behavior and blocks selected project write operations.

Mechanism

postinstall writes AI-agent rules, skills, and a Claude Code command hook

Policy narrative

Installing the package runs install.js automatically. The default emitters populate Claude and generic agent instruction files, copy skills and hook code into .claude, and register a PreToolUse command in .claude/settings.json. The registered hook intercepts editing tools and rejects writes under core/. This is an unconsented install-time mutation of a foreign AI-agent control surface.

Rationale

Although the installed content is package-aligned and no exfiltration or remote execution was found, the npm postinstall automatically installs behavior-bearing Claude Code configuration into the host project. That meets the blocking policy for unconsented install-time foreign AI-agent control-surface mutation.

Evidence

package.jsoninstall.jslib/emit.jslib/settings.jshooks/guard-core.jsCLAUDE.mdAGENTS.md.claude/settings.json.claude/chisel/hooks/guard-core.js.claude/skills/

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L17: const value = () => inline ?? argv[++i]; L18: if (flag === "--agent" || flag === "--agents") options.agents = value().split(","); L19: else if (flag === "--root") options.root = value(); ... L27: const roots = resolveRoots({ override: options.root }); L28: const agents = options.agents || DEFAULT_AGENTS; L29: Referenced control path from install.js: L17: const value = () => inline ?? argv[++i]; L18: if (flag === "--agent" || flag === "--agents") options.agents = value().split(","); L19: else if (flag === "--root") options.root = value(); ... L27: const roots = resolveRoots({ override: options.root }); L28: const agents = options.agents || DEFAULT_AGENTS; L29: Write operation

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L1

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_memory_files = new set(["claude.md", "agents.md"]); function stripmanagedblock(content) { const start = content.indexof(begin); const end = content.indexof(end); if (start === -1 || end === -1 || end < start) return content; return (content.slice(0, start) + content.slice(end + end.length)).replace(/\n{3,}/g, "\n\n").trimstart(); } function pruneemptydirs(di

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

Source & flagged code

4 flagged

package.jsonView file

Lines 5-39json

5 "license": "MIT",

6 "type": "commonjs",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/xfiveco/chisel-ai-toolkit.git"

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "skills/",

16 "rules/",

17 "hooks/",

18 "lib/",

19 "install.js",

20 "uninstall.js",

21 "verify.js",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "install-toolkit": "node install.js",

27 "validate": "node scripts/validate-skills.js",

28 "verify": "node verify.js",

29 "prepublishOnly": "node scripts/validate-skills.js"

30 },

31 "bin": {

32 "chisel-ai-toolkit": "./install.js",

33 "chisel-verify": "./verify.js"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

39

install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

3

4const path = require("node:path");

5

6const pkg = require("./package.json"

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_memory_files = new set(["claude.md", "agents.md"]); function stripmanagedblock(content) { const start = content.indexof(begin); const end = content.indexof(end); if (start === -1 || end === -1 || end < start) return content; return (content.slice(0, start) + content.slice(end + end.length)).replace(/\n{3,}/g, "\n\n").trimstart(); } function pruneemptydirs(di

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg