ai-review-agent@1.13.1

Local AI code review swarm — 15 observe-only default agents powered by Ollama, zero API costs (testgen opt-in)

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The automatic postinstall installation of a Claude command creates a persistent agent extension and warrants a warning. The inspected command is on-demand and the provider restricts network requests to loopback, so the source does not support blocking this release.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs its postinstall hook, unless NODE_ENV is test.

Impact

The command remains available in the user's Claude environment after installation; the inspected source does not show it enabling private-content export or running a review automatically.

Mechanism

The hook creates ~/.claude/commands and copies the bundled ai-review.md command there.

AI rationale

Evidence

package.jsonscripts/postinstall.mjs.claude/commands/ai-review.md

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/postinstall.mjs during package installation.
The install hook copies the bundled /ai-review command into the effective user's Claude commands directory, except when NODE_ENV is test.
The installed command is invoked on demand and has a limited set of allowed tools.
The Ollama provider rejects non-local hosts and sends review messages to its local API.

Evidence against

The inspected setup adds this package's own command; it does not enable prompt, response, or tool-content export in agent settings.
The runtime request is restricted to a loopback Ollama host; no unrelated credential recipient was identified.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 294 KB of source, external domains: 127.0.0.1, github.com, json.schemastore.org

Source & flagged code

5 flagged

package.jsonView file

Lines 20-60json

20 },

21 "bugs": {

22 "url": "https://github.com/unyieldingclaw-dev/ai-code-review-agent/issues"

23 },

24 "engines": {

25 "node": ">=18"

26 },

27 "files": [

28 "dist/",

29 ".claude/commands/",

30 "scripts/postinstall.mjs",

31 "README.md",

32 "LICENSE"

33 ],

34 "bin": {

35 "ai-review-agent": "./dist/cli/index.js",

36 "ai-review-mcp": "./dist/mcp/server.js"

37 },

38 "scripts": {

39 "build": "tsc",

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "dev": "tsx src/cli/index.ts",

42 "test": "vitest run tests/unit",

43 "test:watch": "vitest tests/unit",

44 "test:integration": "vitest run tests/integration",

Medium

Suspicious Lifecycle Evidence

The manifest runs scripts/postinstall.mjs during package installation.

package.jsonView on unpkg · L40

45 "test:coverage": "vitest run --coverage tests/unit",

46 "test:docker": "node scripts/test-docker.mjs",

47 "calibrate": "tsx calibration/calibrate.ts",

48 "calibrate:evidence": "tsx calibration/evidenceVerifierCalibration.ts",

49 "diagnose:truncation": "tsx calibration/responseTruncationDiagnostic.ts",

50 "typecheck": "tsc --noEmit",

51 "lint": "tsc --noEmit",

52 "test:extension": "npm --prefix vscode-extension test",

53 "format": "prettier --write .",

54 "format:check": "prettier --check .",

55 "lint:eslint": "eslint src/ tests/",

56 "check": "npm test && npm run typecheck && npm run build && npm run format:check && npm run lint:eslint"

57 },

58 "dependencies": {

59 "@modelcontextprotocol/sdk": "^1.29.0",

60 "commander": "^12.0.0",

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Plain JS, not compiled TypeScript: `postinstall` can fire before `npm run build` has ever

3// produced dist/ (e.g. a contributor's first `npm install` right after cloning). A dist/-based

4// entrypoint would make npm install itself fail in that window -- this file must always exist

5// and always be runnable with zero build step.

6import { existsSync, mkdirSync, copyFileSync } from 'fs'

7import { fileURLToPath } from 'url'

dist/cli/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/index.js#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

40"postinstall": "node scripts/postinstall.mjs", "dev": "tsx src/cli/index.ts", "test": "vitest run tests/unit", "test:watch": "vitest tests/unit", "test:integration"

Medium

Suspicious Lifecycle Evidence

The manifest runs scripts/postinstall.mjs during package installation.

package.jsonView on unpkg · L40

scripts/postinstall.mjsView file

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/cli/index.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ai-review-agent@1.13.1.

See all versions of ai-review-agent for other recorded verdicts.

Review the evidence and your use of ai-review-agent@1.13.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:02:53.606Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code