registry / AI-agent control-surface risk / respecpow / 0.9.4

respecpow@0.9.4

Spec-Powered AI Development Framework - 融合 OpenSpec 规范驱动 + Superpowers 执行引擎的企业级 AI 辅助编程框架（安装即生效版）

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The postinstall lifecycle performs unconsented writes to global AI-agent control surfaces and registers recurring commands. This meets the policy for blocking install-time control hijacking.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package when either supported tool has its global settings directory.

Impact

The package gains recurring execution in those AI tools when their hook events occur.

Mechanism

The postinstall script reads each global settings file, adds session, prompt, pre-tool, and post-tool command hooks, then writes the settings back.

Policy narrative

The package’s install lifecycle invokes a script that silently registers four recurring command hooks in global CodeBuddy and Claude settings. The script writes the settings files directly and has no consent prompt or saved opt-in gate. These hooks execute package commands on later agent events.

AI rationale

The postinstall lifecycle performs unconsented writes to global AI-agent control surfaces and registers recurring commands. This meets the policy for blocking install-time control hijacking.

Evidence

package.jsonscripts/postinstall.js~/.codebuddy/settings.json~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The package postinstall hook automatically runs scripts/postinstall.js during installation.
That script adds command hooks to global CodeBuddy and Claude settings when the tools are present, with no consent check.
The hook writes the modified Claude settings file and invokes both global registration functions from main().

Evidence against

The separate init and update paths operate on a project root, and command generation targets project-local .claude/commands.
The CodeGraph installation behavior is reached through the explicit init flow.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 799 KB of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

42try { L43: execSync('npm install -g @colbymchenry/codegraph', { L44: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/init/codegraph-step.jsView on unpkg · L42

dist/core/memory/adapters/codebuddy-adapter.jsView file

24constructor() { L25: const localAppData = process.env.LOCALAPPDATA || process.env.APPDATA?.replace('Roaming', 'Local') || ''; L26: this.dataDir = join(localAppData, 'CodeBuddyExtension', 'Data'); ... L85: const content = readFileSync(indexPath, 'utf-8'); L86: const index = JSON.parse(content); L87: return index.conversations.map(conv => ({ ... L167: content, L168: metadata: { L169: id: msg.id,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/memory/adapters/codebuddy-adapter.jsView on unpkg · L24

scripts/postinstall.jsView file

11L12: import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'; L13: import { join } from 'path'; ... L97: if (registered) { L98: writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8'); L99: console.log(' ✓ 已注册 hooks 到 CodeBuddy'); ... L110: function registerClaudeCodeHooks() { L111: const settingsDir = join(homeDir, '.claude'); L112: const settingsPath = join(settingsDir, 'settings.json'); ... L186: if (registered) { L187: writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8'); L188: console.log(' ✓ 已注册 hooks 到 Claude Code');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L11

dist/core/init/engine.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t config = new globalconfigmanager(this.projectroot).load(); const thisfile = fileurltopath(import.meta.url); const packageroot = resolve(thisfile, '..', '..', '..', '..'); const builtindir = join(packageroot, 'builtin'); const srcschemasdir = join(builtindir, 'schemas'); const targetschemasdir = join(this.projectroot, config.paths.schemasdir); if (existssync(srcschemasdir)) { try { const entries = readdirsync(srcschemasdir, { withfiletypes: true }); f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/init/engine.jsView on unpkg

dist/core/init/engine.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/init/engine.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/init/codegraph-step.js

HighShell

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/init/engine.js

HighRuntime Package Installdist/core/init/codegraph-step.js

HighSemantic Analysis Limiteddist/core/init/engine.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Low

Affected versions and remediation

This report applies to respecpow@0.9.4.

See all versions of respecpow for other recorded verdicts.

Avoid installing respecpow@0.9.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 03:23:11.046Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code