registry / AI-agent control-surface risk / respecpow / 0.9.10

respecpow@0.9.10

Spec-Powered AI Development Framework - 融合 OpenSpec 规范驱动 + Superpowers 执行引擎的企业级 AI 辅助编程框架（安装即生效版）

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package defines an npm postinstall hook that silently modifies global AI assistant control settings to install automatic command hooks. This is unconsented install-time control-surface mutation, so the package should be blocked.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with npm, which runs its postinstall hook.

Impact

The package gains automatic execution during assistant sessions, prompt submissions, and tool use.

Mechanism

The hook reads existing CodeBuddy and Claude Code settings, adds missing command hooks, and writes the updated settings without a consent prompt.

Policy narrative

On npm installation, the postinstall script checks for global CodeBuddy and Claude Code settings, adds respecpow commands to their hooks, and saves the settings. Those commands are configured to run during assistant sessions and tool use. The inspected code does not show a consent gate for these global configuration changes.

AI rationale

Evidence

package.jsonscripts/postinstall.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js automatically after installation.
The postinstall script targets global CodeBuddy and Claude Code settings and adds command hooks without checking for user consent.
The added hooks run respecpow commands on session start, prompt submission, and tool use; the script writes the modified settings back to disk.
The script calls both registration functions from its main routine.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 800 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 44-84json

44 },

45 "./command-generation": {

46 "types": "./dist/core/command-generation/index.d.ts",

47 "import": "./dist/core/command-generation/index.js"

48 }

49 },

50 "bin": {

51 "respecpow": "bin/specpow.js"

52 },

53 "engines": {

54 "node": ">=20.19.0"

55 },

56 "scripts": {

57 "build": "node build.js",

58 "dev": "tsc --watch",

59 "test": "vitest run",

60 "test:watch": "vitest",

61 "lint": "eslint src/ --ext .ts",

62 "clean": "rimraf dist",

63 "prepublishOnly": "npm run build",

64 "postinstall": "node scripts/postinstall.js || echo 'Postinstall skipped'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 },

66 "keywords": [

67 "ai",

68 "coding",

69 "spec-driven",

70 "subagent-driven-development",

71 "claude-code",

72 "cursor",

73 "copilot",

74 "workflow",

75 "agent",

76 "skills",

77 "pi-package"

78 ],

79 "files": [

80 "dist/",

81 "bin/",

82 "scripts/",

83 "builtin/schemas/",

84 "builtin/skills/",

dist/core/init/codegraph-step.jsView file

Lines 1-62javascript

1/**

2 * CodeGraph Integration Step

3 *

4 * specpow init 流程中的 CodeGraph 集成步骤：

5 * 1. 检测/安装 codegraph CLI

6 * 2. 映射 SpecPow 检测到的 AI 工具 → codegraph target

7 * 3. 执行 codegraph install --location local

8 * 4. 提醒用户手动运行 codegraph init

9 *

10 * 所有步骤非阻塞，失败仅打印警告。

11 */

dist/core/hooks/session-start-hook.jsView file

Lines 384-424javascript

384 return 'Use `respecpow archive` to merge changes to main specs.';

385 default:

386 return '';

387 }

388}

389// ─── CodeGraph 后台同步 ───────────────────────────────────────

390/**

dist/core/memory/adapters/codebuddy-adapter.jsView file

Lines 4-44javascript

4 * 从 CodeBuddy 的会话存储中读取消息并转换为标准化的 SessionLog 格式

5 *

6 * 存储结构（Windows）：

7 * %LOCALAPPDATA%\CodeBuddyExtension\Data\{userId}\JetBrains\{userId}\history\{projectHash}\

8 * ├── index.json # 会话列表

scripts/postinstall.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script - 安装 specpow 后自动注册 hooks 到 AI 工具

5 *

6 * 实现"安装即生效"：

7 * - 检测已安装的 AI 工具（CodeBuddy、Claude Code）

8 * - 自动注册 hooks 到全局配置

9 * - 无需手动运行 specpow init

10 */

12import { existsSync, readFileSync, writeFileSync, mkdirSync }

dist/core/init/engine.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t config = new globalconfigmanager(this.projectroot).load(); const thisfile = fileurltopath(import.meta.url); const packageroot = resolve(thisfile, '..', '..', '..', '..'); const builtindir = join(packageroot, 'builtin'); const srcschemasdir = join(builtindir, 'schemas'); const targetschemasdir = join(this.projectroot, config.paths.schemasdir); if (existssync(srcschemasdir)) { try { const entries = readdirsync(srcschemasdir, { withfiletypes: true }); f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/init/engine.jsView on unpkg

dist/core/init/engine.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/init/engine.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/init/codegraph-step.js

HighShelldist/core/hooks/session-start-hook.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/init/engine.js

HighRuntime Package Installdist/core/init/codegraph-step.js

HighSemantic Analysis Limiteddist/core/init/engine.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to respecpow@0.9.10.

See all versions of respecpow for other recorded verdicts.

Avoid installing respecpow@0.9.10. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 03:23:44.600Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code