registry / @xfive/chisel-ai-toolkit / 1.5.0

@xfive/chisel-ai-toolkit@1.5.0

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Installation automatically registers a first-party Claude hook that changes agent behavior by blocking edits in the theme’s core directory. The behavior is narrow and package-aligned, but its automatic activation warrants a warning for agent extension lifecycle risk.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall runs install.js when the package is installed.

Impact

Claude edits targeting the project’s core directory are blocked; the hook does not send data over the network.

Mechanism

The installer registers the toolkit’s command hook in the project’s Claude PreToolUse settings.

AI rationale

Evidence

package.jsoninstall.jslib/emit.jslib/settings.jshooks/guard-core.jsuninstall.js.claude/settings.json.claude/chisel/hooks/guard-core.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs its installer automatically after installation.
The installer defaults to Claude and AGENTS, then runs each selected emitter.
The Claude emitter installs a local hook and registers it in the project’s Claude settings.
The registered hook blocks edits under the project’s core directory; it does not contact a network endpoint.
Uninstall removes the toolkit’s hook while preserving other settings.

Evidence against

The hook is narrowly scoped to the project’s core directory and serves the toolkit’s stated theme-protection function.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 34.0 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 3-39json

3 "version": "1.5.0",

4 "description": "Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes",

5 "license": "MIT",

6 "type": "commonjs",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/xfiveco/chisel-ai-toolkit.git"

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "skills/",

16 "rules/",

17 "hooks/",

18 "lib/",

19 "install.js",

20 "uninstall.js",

21 "verify.js",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "install-toolkit": "node install.js",

27 "validate": "node scripts/validate-skills.js",

Medium

Ai Review Evidence

The package runs its installer automatically after installation.

package.jsonView on unpkg · L23

28 "verify": "node verify.js",

29 "prepublishOnly": "node scripts/validate-skills.js"

30 },

31 "bin": {

32 "chisel-ai-toolkit": "./install.js",

33 "chisel-verify": "./verify.js"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

4const path = require("node:path");

6const pkg = require("./package.json"

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end, ignore_begin, ignore_end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_files = { "claude.md": [begin, end], "agents.md": [begin, end], ".prettierignore": [ignore_begin, ignore_end], }; function stripmanagedblock(content, [begin, end]) { const start = content.indexof(begin); const stop = content.indexof(end); if (start === -1

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

lib/emit.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rget, vars, record) { fs.mkdirsync(target, { recursive: true }); for (const entry of fs.readdirsync(source, { withfiletypes: true })) { const from = path.join(source, entry.name); const to = path.join(target, entry.name); if (entry.isdirectory()) { copytree(from, to, vars, record); } else if (text_extensions.has(path.extname(entry.name))) { fs.writefilesync(to, render(fs.readfilesync(from, "utf8"), vars)); record(to); } else { fs.copyfilesync(from, to); record(to); } } } function splicemanagedblock(existing, body, [begin, end] = [begin, end]) { const block = `${begin}\n${body.trim()}\n${end}`; const start = existin

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/emit.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

23], "scripts": { "postinstall": "node install.js", "install-toolkit": "node install.js", "validate": "node scripts/validate-skills.js",

Medium

Ai Review Evidence

The package runs its installer automatically after installation.

package.jsonView on unpkg · L23

install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationuninstall.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/emit.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @xfive/chisel-ai-toolkit@1.5.0.

See all versions of @xfive/chisel-ai-toolkit for other recorded verdicts.

Review the evidence and your use of @xfive/chisel-ai-toolkit@1.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:07:11.563Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.