registry / @xfive/chisel-ai-toolkit / 1.1.0

@xfive/chisel-ai-toolkit@1.1.0

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The automatic postinstall installs first-party agent configuration and a tool hook into the detected project without a separate consent prompt, so a warning is appropriate. The inspected behavior is narrowly scoped and does not establish a concrete attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through npm runs its postinstall hook.

Impact

Agent instructions and hook behavior are changed automatically during installation; the inspected hook does not transfer credentials or contact a network endpoint.

Mechanism

The installer copies agent skills and rules into the detected Chisel theme and adds a Claude tool hook that blocks edits in the theme’s core directory.

AI rationale

Evidence

package.jsoninstall.jslib/roots.jslib/emit.jslib/settings.jshooks/guard-core.jsuninstall.js.claude/skills/.claude/chisel/.claude/settings.json.claude/.chisel-ai-toolkit.jsonCLAUDE.mdAGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall hook runs install.js automatically.
The installer defaults to configuring Claude and general agent instructions, then calls their emitters unless dry-run is selected.
The Claude emitter recursively replaces package-managed skill and reference directories under the project’s .claude directory.
The installer adds a PreToolUse hook to the project’s Claude settings; the hook blocks edits inside the project’s core directory.
The hook checks a requested file path and project directory, with no network request or credential transfer in its inspected behavior.
Uninstall removes managed content and its own settings hook while preserving other settings entries.

Evidence against

The installed hook has a narrow effect: it blocks edits inside core and allows other tool calls.
The inspected setup code does not send data to a network endpoint or collect credentials.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

6 flagged

package.jsonView file

Lines 4-39json

4 "description": "Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes",

5 "license": "MIT",

6 "type": "commonjs",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/xfiveco/chisel-ai-toolkit.git"

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "skills/",

16 "rules/",

17 "hooks/",

18 "lib/",

19 "install.js",

20 "uninstall.js",

21 "verify.js",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "install-toolkit": "node install.js",

27 "validate": "node scripts/validate-skills.js",

Medium

Suspicious Lifecycle Evidence

The package postinstall hook runs install.js automatically.

package.jsonView on unpkg · L24

28 "verify": "node verify.js",

29 "prepublishOnly": "node scripts/validate-skills.js"

30 },

31 "bin": {

32 "chisel-ai-toolkit": "./install.js",

33 "chisel-verify": "./verify.js"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

4const path = require("node:path");

6const pkg = require("./package.json"

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_memory_files = new set(["claude.md", "agents.md"]); function stripmanagedblock(content) { const start = content.indexof(begin); const end = content.indexof(end); if (start === -1 || end === -1 || end < start) return content; return (content.slice(0, start) + content.slice(end + end.length)).replace(/\n{3,}/g, "\n\n").trimstart(); } function pruneemptydirs(di

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

lib/emit.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function render(text, vars) { return text.replace(/\{\{(\w+)\}\}/g, (match, key) => (key in vars ? vars[key] : match)); } const text_extensions = new set([".md", ".mdc", ".json", ".txt", ".yml", ".yaml"]); function copytree(source, target, vars, record) { fs.mkdirsync(target, { recursive: true }); for (const entry of fs.readdirsync(source, { withfiletypes: true })) { const from = path.join(source, entry.name); const to = path.join(target, entry.name); if (entry.isdirectory()) { copytree(from, to, vars, record); } else if (text_extensions.has(path.extname(entry.name))) { fs.writefilesync(to, render(fs.readfilesync(from, "utf8"), vars)); r

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/emit.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

24"scripts": { "postinstall": "node install.js", "install-toolkit": "node install.js", "validate": "

Medium

Suspicious Lifecycle Evidence

The package postinstall hook runs install.js automatically.

package.jsonView on unpkg · L24

install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationuninstall.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/emit.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @xfive/chisel-ai-toolkit@1.1.0.

See all versions of @xfive/chisel-ai-toolkit for other recorded verdicts.

Review the evidence and your use of @xfive/chisel-ai-toolkit@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:04:12.085Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.