registry / @xfive/chisel-ai-toolkit / 1.4.0

@xfive/chisel-ai-toolkit@1.4.0

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The postinstall hook automatically changes project-level Claude behavior by registering an edit-blocking guard, so this merits a warning as an agent extension lifecycle risk. Its detected-theme scope, narrow `core/` behavior, and uninstall path do not establish a malicious attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package in a directory where the installer detects a Chisel theme triggers the postinstall setup.

Impact

The hook changes Claude Code behavior for the project by preventing edits in `core/`; the package provides an uninstall path that removes its hook.

Mechanism

The installer copies the guard into the project and registers it as a `PreToolUse` hook for edit and write operations.

AI rationale

Evidence

package.jsoninstall.jslib/roots.jslib/emit.jslib/settings.jshooks/guard-core.jsuninstall.jslib/manifest.js.claude/settings.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs `node install.js` from its postinstall hook.
The installer selects default agent emitters and writes their files into a detected Chisel theme.
The Claude emitter copies the package’s guard into the project and registers it in shared Claude settings.
The registered hook runs for edit and write operations, and the settings code writes it into `PreToolUse`.
The guard blocks edits only when their target is inside the project’s `core/` directory.
Uninstall removes the package’s guard from shared settings and cleans up files tracked by its manifest.

Evidence against

The installer scopes its automatic setup to a detected Chisel theme; the guard targets that theme’s `core/` directory.
The integration is package-owned and removable through the supplied uninstall command; no credential transfer or network activity was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

Source & flagged code

6 flagged

package.jsonView file

Lines 5-39json

5 "license": "MIT",

6 "type": "commonjs",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/xfiveco/chisel-ai-toolkit.git"

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "skills/",

16 "rules/",

17 "hooks/",

18 "lib/",

19 "install.js",

20 "uninstall.js",

21 "verify.js",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "install-toolkit": "node install.js",

27 "validate": "node scripts/validate-skills.js",

Medium

Suspicious Lifecycle Evidence

The package runs `node install.js` from its postinstall hook.

package.jsonView on unpkg · L25

28 "verify": "node verify.js",

29 "prepublishOnly": "node scripts/validate-skills.js"

30 },

31 "bin": {

32 "chisel-ai-toolkit": "./install.js",

33 "chisel-verify": "./verify.js"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

4const path = require("node:path");

6const pkg = require("./package.json"

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_memory_files = new set(["claude.md", "agents.md"]); function stripmanagedblock(content) { const start = content.indexof(begin); const end = content.indexof(end); if (start === -1 || end === -1 || end < start) return content; return (content.slice(0, start) + content.slice(end + end.length)).replace(/\n{3,}/g, "\n\n").trimstart(); } function pruneemptydirs(di

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

lib/emit.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ", ".yml", ".yaml"]); function copytree(source, target, vars, record) { fs.mkdirsync(target, { recursive: true }); for (const entry of fs.readdirsync(source, { withfiletypes: true })) { const from = path.join(source, entry.name); const to = path.join(target, entry.name); if (entry.isdirectory()) { copytree(from, to, vars, record); } else if (text_extensions.has(path.extname(entry.name))) { fs.writefilesync(to, render(fs.readfilesync(from, "utf8"), vars)); record(to); } else { fs.copyfilesync(from, to); record(to); } } } function splicemanagedblock(existing, body) { const block = `${begin}\n${body.trim()}\n${end}`;

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/emit.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

25postinstall": "node install.js", "install-toolkit": "node install.js", "validate": "node scripts/valid

Medium

Suspicious Lifecycle Evidence

The package runs `node install.js` from its postinstall hook.

package.jsonView on unpkg · L25

install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationuninstall.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/emit.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @xfive/chisel-ai-toolkit@1.4.0.

See all versions of @xfive/chisel-ai-toolkit for other recorded verdicts.

Review the evidence and your use of @xfive/chisel-ai-toolkit@1.4.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:07:04.769Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.