dojofoo@0.0.1
Installable coding dojos that turn your AI agent into a sensei.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe explicit CLI commands expose meaningful supply-chain and agent-extension risk, warranting a warning. No concrete malicious behavior occurs on package installation or import.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
User runs dojofoo install, add, or track.
Impact
A user-selected or registry-provided dojo can execute during add and add agent commands to the project.
Mechanism
Project-local agent setup and execution of user-selected dojo lifecycle/dependency code.
AI rationale
The explicit CLI commands expose meaningful supply-chain and agent-extension risk, warranting a warning. No concrete malicious behavior occurs on package installation or import.
Evidence
package.jsondist/index.jsREADME.md.agents/commands/dojo.md.agents/commands/kata.md.claude/settings.json.dojo/cassettes
Network endpoints1
dojocho.ai/api/v1/events
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js: install --agent writes and links agent command files, including .claude/settings.json.
- dist/index.js: add accepts URL/npm sources, installs extracted dependencies, then executes added dojo prepare.sh.
- dist/index.js: track reads detected agent session logs only when explicitly invoked, then stores a local cassette.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- All configuration, package installation, shell execution, and session capture paths require explicit CLI commands.
- Telemetry posts only UUID, course ID, event, timestamp, and optional kata; no session content is sent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
10 flaggeddist/ui/server/_ssr/router-D7IXsm7H.mjsView file
11import { createJiti } from "jiti";
L12: import { execFileSync, spawn } from "node:child_process";
L13: import readline from "node:readline";
High
Child Process
Package source references child process execution.
dist/ui/server/_ssr/router-D7IXsm7H.mjsView on unpkg · L1111Cross-file remote execution chain: dist/ui/server/_ssr/router-D7IXsm7H.mjs spawns dist/ui/server/_libs/@tanstack/react-router+[...].mjs; helper contains network access plus dynamic code execution.
L11: import { createJiti } from "jiti";
L12: import { execFileSync, spawn } from "node:child_process";
L13: import readline from "node:readline";
...
L215: const card = await requestHandler.getAgentCard();
L216: return c.json(card);
L217: } catch (err) {
...
L256: for await (const event of stream) {
L257: const line = `data: ${JSON.stringify(event)}\n\n`;
L258: controller.enqueue(encoder.encode(line));
...
L287: registries: {
L288: dojocho: "https://dojocho.ai/r/{name}.json",
L289: ...userConfig.registries
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/ui/server/_ssr/router-D7IXsm7H.mjsView on unpkg · L11Findings
7 High6 Medium7 Low
HighChild Processdist/ui/server/_ssr/router-D7IXsm7H.mjs
HighShell
HighSame File Env Network Executiondist/index.js
HighCloud Metadata Accessdist/ui/server/_libs/@ai-sdk/provider-utils+[...].mjs
HighCross File Remote Execution Contextdist/ui/server/_ssr/router-D7IXsm7H.mjs
HighSemantic Analysis Limiteddist/ui/public/assets/routes-BLXifQrA.js
HighKnown Malware Source Similaritydist/ui/public/assets/diagram-Q27KOJAE-RHkbc-l3.js
MediumDynamic Requiredist/ui/server/_ssr/pdf-CjYZSQ3m.mjs
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Source Filedist/ui/server/_libs/shikijs__langs.mjs
Affected versions and remediation
This report applies to dojofoo@0.0.1.
See all versions of dojofoo for other recorded verdicts.
- Review the evidence and your use of dojofoo@0.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.