registry / kitstarter-cli / 0.5.1

kitstarter-cli@0.5.1

Make your AI coding agent ask before it builds, stay lean, and stop looking AI-made. For Claude Code, Codex, and Antigravity.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The explicit CLI installer deploys a package-owned engine and registers Claude Code and Codex lifecycle hooks. Those hooks run local package scripts during future agent events. No unconsented npm lifecycle mutation or confirmed data-exfiltration chain was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `npx kitstarter-cli` or `kitstarter` without a subcommand.

Impact

Future Claude Code/Codex sessions invoke package-controlled local scripts through project or user configuration.

Mechanism

Explicit AI-agent hook and skill installation with local Node hook dispatch.

Rationale

No concrete malicious behavior was found. Per policy, the intentional first-party AI-agent extension setup warrants a warning rather than a block.

Evidence

package.jsoncli.mjsinstall.mjshooks/lib/wiring.mjshooks/lib/codex-wiring.mjshooks/codex-hook.mjsbin/knowledge-map.mjs.claude/settings.json.claude/kitstarter.claude/skills.claude/output-styles.codex/hooks.json.codex/kitstarter.agents/skillsAGENTS.md

Network endpoints1

kitstarter.dev/api/verify

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`install.mjs` runs from the default user-invoked CLI path and writes `.claude` and `.codex` integrations.
`hooks/lib/wiring.mjs` adds command hooks to `.claude/settings.json`.
`hooks/lib/codex-wiring.mjs` adds command hooks to `.codex/hooks.json`.
Installed hooks execute package scripts for agent lifecycle events via `hooks/codex-hook.mjs`.
`install.mjs` POSTs a user-entered email to `https://kitstarter.dev/api/verify` during interactive license verification.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle script.
Hook wiring is performed only after explicit CLI invocation, not npm installation.
Wiring merges existing configuration and removes only commands marked `kitstarter`.
No credential harvesting, arbitrary remote payload loading, eval/vm use, or network exfiltration was found.
Child-process calls run Node against bounded local package scripts; `bin/knowledge-map.mjs` only opens a generated local HTML file.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 28 file(s), 209 KB of source, external domains: kitstarter.dev

Source & flagged code

3 flagged

bin/knowledge-map.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// kitstarter knowledge map: `kitstarter progress --map` renders the learner's concept graph

3// as one self-contained HTML file and opens it (or just prints where it is).

4//

5// node bin/knowledge-map.mjs [--no-open]

6//

7// Reads ./.kitstarter/concepts.json (the graph the tutor + course write) and, if present,

8// course-progress.json for the footer. Writes ./.kitstarter/knowledge-map.html: inline

9// CSS + JS, zero external requests, zero libraries, solid colors only (the kit's own slop

10// detector flags flat gradients, so there are none). Layout is deliberately force-free:

11// the most-connected concept sits in the center, the rest fan out on concentric rings

12// with a little deterministic jitter so it reads organic, not gridded.

13//

14// Fail-open everywhere: an empty or missing graph still produces a friendly page, and a

15// browser that refuses to open never fails the command - the path is always printed.

17import { writeFileSync, mkdirSync } from "node:fs";

18import { join } from "node:path";

19import { spawn } from "node:child_process";

20import { loadConcepts, conceptStats } from "../hooks/lib/concepts.mjs";

High

Child Process

Package source references child process execution.

bin/knowledge-map.mjsView on unpkg · L18

21import { readJson, projectDir } from "../hooks/lib/state.mjs";

23const cwd = process.cwd();

24const graph = loadConcepts(cwd);

25const stats = conceptStats(cwd);

26const course = readJson(join(projectDir(cwd), "course-progress.json"), null);

27const journey = readJson(join(projectDir(cwd), "journey.json"), null) || {};

28const seed = readJson(join(projectDir(cwd), "seed.json"), null) || {};

29const project = journey.project || seed.project || "";

31const esc = (s) =>

32 String(s).replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">").replace(/"/g, """);

34const friendly = (iso) => {

35 const d = new Date(iso + "T12:00:00");

36 return Number.isNaN(d.getTime())

37 ? iso

38 : d.toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" });

•matchType = previous_version_dangerous_delta matchedPackage = kitstarter-cli@0.5.0 matchedIdentity = npm:a2l0c3RhcnRlci1jbGk:0.5.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/knowledge-map.mjsView on unpkg

cli.mjsView file

Lines 285-325javascript

285 say(pc.yellow("!") + " AGENTS.md has stray kitstarter markers - left untouched so nothing of yours is lost");

286 }

287 }

288

289 say(pc.dim("kept (they're yours): CLAUDE.md, AGENTS.md outside the kitstarter block, .kitstarter/ (your roadmap + decisions)"));

290 say(pc.dim("kept: ~/.kitstarter (your profile) - delete it yourself if you want a full reset"));

Source & flagged code

3 flagged · loading source

bin/knowledge-map.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/knowledge-map.mjsView on unpkg

18import { join } from "node:path"; L19: import { spawn } from "node:child_process"; L20: import { loadConcepts, conceptStats } from "../hooks/lib/concepts.mjs";

High

Child Process

Package source references child process execution.

bin/knowledge-map.mjsView on unpkg · L18

cli.mjsView file

305if (codexDoctor && !process.argv.includes("--claude")) { L306: const r = spawnSync(process.execPath, [codexDoctor, ...(value ? [value] : [])], { stdio: "inherit" }); L307: process.exit(r.status ?? 1); ... L315: if (!script || script === candidates[2]) { L316: say(pc.yellow("no kitstarter engine installed here - run: npx kitstarter-cli")); L317: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.mjsView on unpkg · L305

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltabin/knowledge-map.mjs

HighChild Processbin/knowledge-map.mjs

HighShell

HighRuntime Package Installcli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bin/knowledge-map.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// kitstarter knowledge map: `kitstarter progress --map` renders the learner's concept graph

3// as one self-contained HTML file and opens it (or just prints where it is).

4//

5// node bin/knowledge-map.mjs [--no-open]

6//

7// Reads ./.kitstarter/concepts.json (the graph the tutor + course write) and, if present,

8// course-progress.json for the footer. Writes ./.kitstarter/knowledge-map.html: inline

9// CSS + JS, zero external requests, zero libraries, solid colors only (the kit's own slop

10// detector flags flat gradients, so there are none). Layout is deliberately force-free:

11// the most-connected concept sits in the center, the rest fan out on concentric rings

12// with a little deterministic jitter so it reads organic, not gridded.

13//

14// Fail-open everywhere: an empty or missing graph still produces a friendly page, and a

15// browser that refuses to open never fails the command - the path is always printed.

17import { writeFileSync, mkdirSync } from "node:fs";

18import { join } from "node:path";

19import { spawn } from "node:child_process";

20import { loadConcepts, conceptStats } from "../hooks/lib/concepts.mjs";

High

Child Process

Package source references child process execution.

bin/knowledge-map.mjsView on unpkg · L18

21import { readJson, projectDir } from "../hooks/lib/state.mjs";

23const cwd = process.cwd();

24const graph = loadConcepts(cwd);

25const stats = conceptStats(cwd);

26const course = readJson(join(projectDir(cwd), "course-progress.json"), null);

27const journey = readJson(join(projectDir(cwd), "journey.json"), null) || {};

28const seed = readJson(join(projectDir(cwd), "seed.json"), null) || {};

29const project = journey.project || seed.project || "";

31const esc = (s) =>

32 String(s).replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">").replace(/"/g, """);

34const friendly = (iso) => {

35 const d = new Date(iso + "T12:00:00");

36 return Number.isNaN(d.getTime())

37 ? iso

38 : d.toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" });

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/knowledge-map.mjsView on unpkg

cli.mjsView file

Lines 285-325javascript

285 say(pc.yellow("!") + " AGENTS.md has stray kitstarter markers - left untouched so nothing of yours is lost");

286 }

287 }

288

289 say(pc.dim("kept (they're yours): CLAUDE.md, AGENTS.md outside the kitstarter block, .kitstarter/ (your roadmap + decisions)"));

290 say(pc.dim("kept: ~/.kitstarter (your profile) - delete it yourself if you want a full reset"));