registry / AI-agent control-surface risk / respecpow

respecpow

Spec-Powered AI Development Framework - 融合 OpenSpec 规范驱动 + Superpowers 执行引擎的企业级 AI 辅助编程框架（安装即生效版）

This report shows the evidence for respecpow@1.0.0. 12 of 12 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The manifest activates a postinstall script that mutates global AI-agent control settings without consent and registers recurring command hooks. This meets the policy for blocking unconsented install-time agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with npm, when a CodeBuddy or Claude configuration directory exists.

Impact

The configured agents can run respecpow commands automatically on later events.

Mechanism

The script reads the global settings, adds command hooks for session and tool events, and writes the settings file without a consent prompt.

Policy narrative

During npm installation, the package checks for global CodeBuddy and Claude configuration directories and writes command hooks into their settings. The hooks run respecpow on agent session and tool events, creating an automatic execution path without a consent prompt.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.codebuddy/settings.json~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js during npm installation.
The postinstall script targets global CodeBuddy and Claude settings when their configuration directories exist.
It adds commands for agent session and tool events, including commands that run respecpow through npx.
When hooks are added, the script writes the modified settings file without asking the user.
The script invokes both registration functions directly from its main routine.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 97 file(s), 811 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 44-84json

44 },

45 "./command-generation": {

46 "types": "./dist/core/command-generation/index.d.ts",

47 "import": "./dist/core/command-generation/index.js"

48 }

49 },

50 "bin": {

51 "respecpow": "bin/specpow.js"

52 },

53 "engines": {

54 "node": ">=20.19.0"

55 },

56 "scripts": {

57 "build": "node build.js",

58 "dev": "tsc --watch",

59 "test": "vitest run",

60 "test:watch": "vitest",

61 "lint": "eslint src/ --ext .ts",

62 "clean": "rimraf dist",

63 "prepublishOnly": "npm run build",

64 "postinstall": "node scripts/postinstall.js || echo 'Postinstall skipped'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 },

66 "keywords": [

67 "ai",

68 "coding",

69 "spec-driven",

70 "subagent-driven-development",

71 "claude-code",

72 "cursor",

73 "copilot",

74 "workflow",

75 "agent",

76 "skills",

77 "pi-package"

78 ],

79 "files": [

80 "dist/",

81 "bin/",

82 "scripts/",

83 "builtin/schemas/",

84 "builtin/skills/",

dist/core/init/codegraph-step.jsView file

Lines 1-62javascript

1/**

2 * CodeGraph Integration Step

3 *

4 * specpow init 流程中的 CodeGraph 集成步骤：

5 * 1. 检测/安装 codegraph CLI

6 * 2. 映射 SpecPow 检测到的 AI 工具 → codegraph target

7 * 3. 执行 codegraph install --location local

8 * 4. 提醒用户手动运行 codegraph init

9 *

10 * 所有步骤非阻塞，失败仅打印警告。

11 */

dist/core/hooks/session-start-hook.jsView file

Lines 442-482javascript

442 return 'Use `respecpow archive` to merge changes to main specs.';

443 default:

444 return '';

445 }

446}

447// ─── CodeGraph 后台同步 ───────────────────────────────────────

448/**

dist/core/memory/adapters/codebuddy-adapter.jsView file

Lines 4-44javascript

4 * 从 CodeBuddy 的会话存储中读取消息并转换为标准化的 SessionLog 格式

5 *

6 * 存储结构（Windows）：

7 * %LOCALAPPDATA%\CodeBuddyExtension\Data\{userId}\JetBrains\{userId}\history\{projectHash}\

8 * ├── index.json # 会话列表

scripts/postinstall.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script - 安装 specpow 后自动注册 hooks 到 AI 工具

5 *

6 * 实现"安装即生效"：

7 * - 检测已安装的 AI 工具（CodeBuddy、Claude Code）

8 * - 自动注册 hooks 到全局配置

9 * - 无需手动运行 specpow init

10 */

12import { existsSync, readFileSync, writeFileSync, mkdirSync }

dist/core/init/engine.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t config = new globalconfigmanager(this.projectroot).load(); const thisfile = fileurltopath(import.meta.url); const packageroot = resolve(thisfile, '..', '..', '..', '..'); const builtindir = join(packageroot, 'builtin'); const srcschemasdir = join(builtindir, 'schemas'); const targetschemasdir = join(this.projectroot, config.paths.schemasdir); if (existssync(srcschemasdir)) { try { const entries = readdirsync(srcschemasdir, { withfiletypes: true }); f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/init/engine.jsView on unpkg

dist/core/init/engine.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/init/engine.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/init/codegraph-step.js

HighShelldist/core/hooks/session-start-hook.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/init/engine.js

HighRuntime Package Installdist/core/init/codegraph-step.js

HighSemantic Analysis Limiteddist/core/init/engine.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to respecpow@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing respecpow@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 03:23:48.100Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

12 known versions

1.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 9, 2026, 8:16 AM 0.9.12MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 9, 2026, 7:17 AM 0.9.11MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 9, 2026, 7:09 AM 0.9.10MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 9, 2026, 6:57 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code