ai-review-agent@1.13.0

Local AI code review swarm — 15 observe-only default agents powered by Ollama, zero API costs (testgen opt-in)

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The package's postinstall hook installs its own Claude command into the user's home configuration without an explicit setup command. The command's reviewed behavior runs a local Ollama review on invocation, so this supports a warning for agent extension lifecycle risk rather than a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package, except when NODE_ENV is test.

Impact

The command becomes available in the user's Claude command set and can run a local code review when invoked.

Mechanism

The postinstall script creates ~/.claude/commands if needed and copies ai-review.md there.

AI rationale

Evidence

package.jsonscripts/postinstall.mjs.claude/commands/ai-review.md~/.claude/commands/ai-review.md

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook runs scripts/postinstall.mjs during package installation.
The hook copies the package-owned ai-review command into the installing user's ~/.claude/commands directory.
The installed command runs a local Ollama review when invoked.

Evidence against

The inspected command describes local Ollama use and requires a user invocation to run the review.
The inspected source does not establish credential disclosure, destructive behavior, or remote payload execution.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 289 KB of source, external domains: 127.0.0.1, github.com, json.schemastore.org

Source & flagged code

5 flagged

package.jsonView file

Lines 20-60json

20 },

21 "bugs": {

22 "url": "https://github.com/unyieldingclaw-dev/ai-code-review-agent/issues"

23 },

24 "engines": {

25 "node": ">=18"

26 },

27 "files": [

28 "dist/",

29 ".claude/commands/",

30 "scripts/postinstall.mjs",

31 "README.md",

32 "LICENSE"

33 ],

34 "bin": {

35 "ai-review-agent": "./dist/cli/index.js",

36 "ai-review-mcp": "./dist/mcp/server.js"

37 },

38 "scripts": {

39 "build": "tsc",

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "dev": "tsx src/cli/index.ts",

42 "test": "vitest run tests/unit",

Medium

Suspicious Lifecycle Evidence

The postinstall hook runs scripts/postinstall.mjs during package installation.

package.jsonView on unpkg · L40

43 "test:watch": "vitest tests/unit",

44 "test:integration": "vitest run tests/integration",

45 "test:coverage": "vitest run --coverage tests/unit",

46 "calibrate": "tsx calibration/calibrate.ts",

47 "calibrate:evidence": "tsx calibration/evidenceVerifierCalibration.ts",

48 "diagnose:truncation": "tsx calibration/responseTruncationDiagnostic.ts",

49 "typecheck": "tsc --noEmit",

50 "lint": "tsc --noEmit",

51 "test:extension": "npm --prefix vscode-extension test",

52 "format": "prettier --write .",

53 "format:check": "prettier --check .",

54 "lint:eslint": "eslint src/ tests/",

55 "check": "npm test && npm run typecheck && npm run build && npm run format:check && npm run lint:eslint"

56 },

57 "dependencies": {

58 "@modelcontextprotocol/sdk": "^1.29.0",

59 "commander": "^12.0.0",

60 "update-notifier": "^7.3.1"

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Plain JS, not compiled TypeScript: `postinstall` can fire before `npm run build` has ever

3// produced dist/ (e.g. a contributor's first `npm install` right after cloning). A dist/-based

4// entrypoint would make npm install itself fail in that window -- this file must always exist

5// and always be runnable with zero build step.

6import { existsSync, mkdirSync, copyFileSync } from 'fs'

7import { fileURLToPath } from 'url'

dist/cli/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/index.js#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

40"postinstall": "node scripts/postinstall.mjs", "dev": "tsx src/cli/index.ts", "test": "vites

Medium

Suspicious Lifecycle Evidence

The postinstall hook runs scripts/postinstall.mjs during package installation.

package.jsonView on unpkg · L40

scripts/postinstall.mjsView file

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/cli/index.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ai-review-agent@1.13.0.

See all versions of ai-review-agent for other recorded verdicts.

Review the evidence and your use of ai-review-agent@1.13.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:02:50.437Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code