registry / @xfive/chisel-ai-toolkit / 1.6.0

@xfive/chisel-ai-toolkit@1.6.0

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The automatic postinstall agent configuration is a guarded, package-owned extension setup and merits a warning. Its observed hook protects the theme's core directory; source inspection found no credential transfer or other concrete attack behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs its postinstall script.

Impact

Claude Code edits to the theme's core directory are blocked; the installer also changes project agent configuration without a separate setup command.

Mechanism

The installer adds the hook file and registers it in the project's Claude Code PreToolUse settings.

AI rationale

Evidence

package.jsoninstall.jslib/emit.jslib/settings.jshooks/guard-core.jslib/roots.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall automatically runs the installer.
The installer defaults to Claude and another agent integration, then emits their files into the resolved project root.
For Claude, the emitter installs a hook and calls the settings helper to register it in the project's settings.
The settings helper targets the project's .claude/settings.json and adds a PreToolUse hook.
The hook blocks edits under the project's core directory; inspected code shows no credential transfer or network endpoint.

Evidence against

The integration is package-owned and its hook protects the Chisel theme's core directory from edits that would be overwritten by updates.
The installer resolves a theme root and supports a dry-run option; the hook otherwise has no effect outside the core directory.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

25"postinstall": "node install.js", "install-toolkit": "node install.js", "validate": "node sc

Medium

Suspicious Lifecycle Evidence

The package postinstall automatically runs the installer.

package.jsonView on unpkg · L25

install.jsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L17: const value = () => inline ?? argv[++i]; L18: if (flag === "--agent" || flag === "--agents") options.agents = value().split(","); L19: else if (flag === "--root") options.root = value(); ... L27: const roots = resolveRoots({ override: options.root }); L28: const agents = options.agents || DEFAULT_AGENTS; L29: Referenced control path from install.js: L17: const value = () => inline ?? argv[++i]; L18: if (flag === "--agent" || flag === "--agents") options.agents = value().split(","); L19: else if (flag === "--root") options.root = value(); ... L27: const roots = resolveRoots({ override: options.root }); L28: const agents = options.agents || DEFAULT_AGENTS; L29: Write operation

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L1

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end, ignore_begin, ignore_end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_files = { "claude.md": [begin, end], "agents.md": [begin, end], ".prettierignore": [ignore_begin, ignore_end], }; function stripmanagedblock(content, [begin, end]) { const start = content.indexof(begin); const stop = content.indexof(end); if (start === -1

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

lib/emit.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rget, vars, record) { fs.mkdirsync(target, { recursive: true }); for (const entry of fs.readdirsync(source, { withfiletypes: true })) { const from = path.join(source, entry.name); const to = path.join(target, entry.name); if (entry.isdirectory()) { copytree(from, to, vars, record); } else if (text_extensions.has(path.extname(entry.name))) { fs.writefilesync(to, render(fs.readfilesync(from, "utf8"), vars)); record(to); } else { fs.copyfilesync(from, to); record(to); } } } function splicemanagedblock(existing, body, [begin, end] = [begin, end]) { const block = `${begin}\n${body.trim()}\n${end}`; const start = existin

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/emit.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

25"postinstall": "node install.js", "install-toolkit": "node install.js", "validate": "node sc

Medium

Suspicious Lifecycle Evidence

The package postinstall automatically runs the installer.

package.jsonView on unpkg · L25

install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationuninstall.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/emit.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @xfive/chisel-ai-toolkit@1.6.0.

See all versions of @xfive/chisel-ai-toolkit for other recorded verdicts.

Review the evidence and your use of @xfive/chisel-ai-toolkit@1.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 14:34:14.505Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.