registry / @xfive/chisel-ai-toolkit / 1.7.1

@xfive/chisel-ai-toolkit@1.7.1

Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The postinstall silently enables a package-owned Claude hook in project settings, leaving a concrete agent-integration lifecycle risk. Its observed effect is limited to protecting the Chisel theme’s `core/` directory, so the evidence supports a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through npm runs its postinstall script.

Impact

Claude receives an automatically enabled project hook that can block edits under `core/`. No data transfer or unrelated account action was identified in the inspected behavior.

Mechanism

The installer detects a Chisel theme, copies the hook into its project-local Claude directory, and adds a PreToolUse command to `.claude/settings.json`.

AI rationale

Evidence

package.jsoninstall.jslib/roots.jslib/emit.jslib/settings.jshooks/guard-core.js.claude/settings.json.claude/chisel/hooks/guard-core.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` runs `install.js` automatically during postinstall, which dispatches the configured agent emitters.
The installer defaults to Claude and generic agents, and resolves the target to a detected Chisel theme directory.
The Claude emitter installs the package-owned hook and registers it in the project’s `.claude/settings.json` for edit and write operations.
The hook checks whether a target is inside the theme’s `core` directory, where it blocks the edit.
The uninstall path removes the package’s hook while preserving the rest of the shared settings file.

Evidence against

The integration is scoped to a detected Chisel theme and installs a hook shipped by this package.
The hook’s observed behavior is to prevent edits in the theme’s `core` directory; no credential transfer or unrelated account action was identified in the inspected installer and hook source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

Source & flagged code

6 flagged

package.jsonView file

Lines 4-39json

4 "description": "Chisel AI toolkit — skills, rules and reference docs for AI coding agents working on Chisel WordPress themes",

5 "license": "MIT",

6 "type": "commonjs",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/xfiveco/chisel-ai-toolkit.git"

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "skills/",

16 "rules/",

17 "hooks/",

18 "lib/",

19 "install.js",

20 "uninstall.js",

21 "verify.js",

22 "README.md"

23 ],

24 "scripts": {

25 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "install-toolkit": "node install.js",

27 "validate": "node scripts/validate-skills.js",

Medium

Suspicious Lifecycle Evidence

`package.json` runs `install.js` automatically during postinstall, which dispatches the configured agent emitters.

package.jsonView on unpkg · L24

28 "verify": "node verify.js",

29 "prepublishOnly": "node scripts/validate-skills.js"

30 },

31 "bin": {

32 "chisel-ai-toolkit": "./install.js",

33 "chisel-verify": "./verify.js"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

4const path = require("node:path");

6const pkg = require("./package.json"

uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node "use strict"; const fs = require("node:fs"); const path = require("node:path"); const pkg = require("./package.json"); const { resolveroots } = require("./lib/roots"); const manifest = require("./lib/manifest"); const { begin, end, ignore_begin, ignore_end } = require("./lib/emit"); const settings = require("./lib/settings"); const managed_files = { "claude.md": [begin, end], "agents.md": [begin, end], ".prettierignore": [ignore_begin, ignore_end], }; function stripmanagedblock(content, [begin, end]) { const start = content.indexof(begin); const stop = content.indexof(end); if (start === -1

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

uninstall.jsView on unpkg

lib/emit.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rget, vars, record) { fs.mkdirsync(target, { recursive: true }); for (const entry of fs.readdirsync(source, { withfiletypes: true })) { const from = path.join(source, entry.name); const to = path.join(target, entry.name); if (entry.isdirectory()) { copytree(from, to, vars, record); } else if (text_extensions.has(path.extname(entry.name))) { fs.writefilesync(to, render(fs.readfilesync(from, "utf8"), vars)); record(to); } else { fs.copyfilesync(from, to); record(to); } } } function splicemanagedblock(existing, body, [begin, end] = [begin, end]) { const block = `${begin}\n${body.trim()}\n${end}`; const start = existin

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/emit.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

24"scripts": { "postinstall": "node install.js", "install-toolkit": "node install.js", "

Medium

Suspicious Lifecycle Evidence

`package.json` runs `install.js` automatically during postinstall, which dispatches the configured agent emitters.

package.jsonView on unpkg · L24

install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationuninstall.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/emit.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @xfive/chisel-ai-toolkit@1.7.1.

See all versions of @xfive/chisel-ai-toolkit for other recorded verdicts.

Review the evidence and your use of @xfive/chisel-ai-toolkit@1.7.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 16:50:12.357Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.