registry / AI-agent control-surface risk / respecpow / 0.9.12

respecpow@0.9.12

Spec-Powered AI Development Framework - 融合 OpenSpec 规范驱动 + Superpowers 执行引擎的企业级 AI 辅助编程框架（安装即生效版）

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The active postinstall lifecycle unconsentedly writes command hooks into global AI-agent settings, creating a persistent agent control surface. This meets the policy for blocking install-time mutation of a foreign or broad AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with its postinstall lifecycle enabled, when CodeBuddy or Claude Code settings directories exist.

Impact

Later agent sessions, prompts, and tool actions invoke respecpow hook handlers automatically.

Mechanism

The script adds command hooks to global settings.json files and saves them without asking for consent.

Policy narrative

During npm installation, the postinstall script checks for CodeBuddy and Claude Code settings directories, adds respecpow command hooks to their global settings, and writes those files without a consent prompt. The hooks run automatically in later agent sessions and around tool use.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.codebuddy/settings.json~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js automatically during installation.
scripts/postinstall.js adds commands to global CodeBuddy and Claude Code hook settings without a consent check.
The injected commands run package hook handlers on session start, prompt submission, and before or after tool use.
The install hook persists the changed global settings for tools that are already present.

Evidence against

Other reviewed paths show project-scoped init/update operations or a CodeGraph install initiated by the explicit init flow.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 802 KB of source

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

42try { L43: execSync('npm install -g @colbymchenry/codegraph', { L44: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/init/codegraph-step.jsView on unpkg · L42

dist/core/hooks/session-start-hook.jsView file

450stdio: 'ignore', L451: shell: true, L452: });

High

Shell

Package source references shell execution.

dist/core/hooks/session-start-hook.jsView on unpkg · L450

dist/core/memory/adapters/codebuddy-adapter.jsView file

24constructor() { L25: const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA?.replace('Roaming', 'Local') || ''; L26: this.dataDir = join(localAppData, 'CodeBuddyExtension', 'Data'); ... L85: const content = readFileSync(indexPath, 'utf-8'); L86: const index = JSON.parse(content); L87: return index.conversations.map(conv => ({ ... L167: content, L168: metadata: { L169: id: msg.id,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/memory/adapters/codebuddy-adapter.jsView on unpkg · L24

scripts/postinstall.jsView file

11L12: import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'; L13: import { join } from 'path'; ... L97: if (registered) { L98: writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8'); L99: console.log(' ✓ 已注册 hooks 到 CodeBuddy'); ... L110: function registerClaudeCodeHooks() { L111: const settingsDir = join(homeDir, '.claude'); L112: const settingsPath = join(settingsDir, 'settings.json'); ... L186: if (registered) { L187: writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8'); L188: console.log(' ✓ 已注册 hooks 到 Claude Code');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L11

dist/core/init/engine.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t config = new globalconfigmanager(this.projectroot).load(); const thisfile = fileurltopath(import.meta.url); const packageroot = resolve(thisfile, '..', '..', '..', '..'); const builtindir = join(packageroot, 'builtin'); const srcschemasdir = join(builtindir, 'schemas'); const targetschemasdir = join(this.projectroot, config.paths.schemasdir); if (existssync(srcschemasdir)) { try { const entries = readdirsync(srcschemasdir, { withfiletypes: true }); f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/init/engine.jsView on unpkg

dist/core/init/engine.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/init/engine.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/init/codegraph-step.js

HighShelldist/core/hooks/session-start-hook.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/init/engine.js

HighRuntime Package Installdist/core/init/codegraph-step.js

HighSemantic Analysis Limiteddist/core/init/engine.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to respecpow@0.9.12.

See all versions of respecpow for other recorded verdicts.

Avoid installing respecpow@0.9.12. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 03:23:50.382Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code