registry / AI-agent control-surface risk / respecpow / 0.9.8

respecpow@0.9.8

Spec-Powered AI Development Framework - 融合 OpenSpec 规范驱动 + Superpowers 执行引擎的企业级 AI 辅助编程框架（安装即生效版）

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The install-time script makes an unconsented mutation to broad global AI-agent control settings and installs commands that run on later agent events. This meets the policy for blocking unconsented postinstall control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package when either tool's global settings directory exists.

Impact

The agent runs respecpow hook commands in later sessions and tool interactions.

Mechanism

The postinstall script edits settings.json and registers commands for agent lifecycle events.

Policy narrative

The package's install hook automatically edits detected global AI-tool settings and registers respecpow commands for session and tool events. The script checks for existing settings and duplicate registrations, but does not obtain user consent before adding these lifecycle hooks.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.codebuddy/settings.json~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js during installation.
The postinstall script runs registration for Claude Code and CodeBuddy automatically.
When a Claude Code settings directory exists, the script targets its global settings.json.
The script adds commands to agent lifecycle hooks, including session-start and pre-tool-call hooks.
It writes the modified settings file after registering hooks; the duplicate check does not ask for user consent.

Evidence against

Registration is limited to detected global settings directories and skips hooks that already exist.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 799 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 44-84json

44 },

45 "./command-generation": {

46 "types": "./dist/core/command-generation/index.d.ts",

47 "import": "./dist/core/command-generation/index.js"

48 }

49 },

50 "bin": {

51 "respecpow": "bin/specpow.js"

52 },

53 "engines": {

54 "node": ">=20.19.0"

55 },

56 "scripts": {

57 "build": "node build.js",

58 "dev": "tsc --watch",

59 "test": "vitest run",

60 "test:watch": "vitest",

61 "lint": "eslint src/ --ext .ts",

62 "clean": "rimraf dist",

63 "prepublishOnly": "npm run build",

64 "postinstall": "node scripts/postinstall.js || echo 'Postinstall skipped'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 },

66 "keywords": [

67 "ai",

68 "coding",

69 "spec-driven",

70 "subagent-driven-development",

71 "claude-code",

72 "cursor",

73 "copilot",

74 "workflow",

75 "agent",

76 "skills",

77 "pi-package"

78 ],

79 "files": [

80 "dist/",

81 "bin/",

82 "scripts/",

83 "builtin/schemas/",

84 "builtin/skills/",

dist/core/init/codegraph-step.jsView file

Lines 1-62javascript

1/**

2 * CodeGraph Integration Step

3 *

4 * specpow init 流程中的 CodeGraph 集成步骤：

5 * 1. 检测/安装 codegraph CLI

6 * 2. 映射 SpecPow 检测到的 AI 工具 → codegraph target

7 * 3. 执行 codegraph install --location local

8 * 4. 提醒用户手动运行 codegraph init

9 *

10 * 所有步骤非阻塞，失败仅打印警告。

11 */

dist/core/hooks/session-start-hook.jsView file

Lines 384-424javascript

384 return 'Use `respecpow archive` to merge changes to main specs.';

385 default:

386 return '';

387 }

388}

389// ─── CodeGraph 后台同步 ───────────────────────────────────────

390/**

dist/core/memory/adapters/codebuddy-adapter.jsView file

Lines 4-44javascript

4 * 从 CodeBuddy 的会话存储中读取消息并转换为标准化的 SessionLog 格式

5 *

6 * 存储结构（Windows）：

7 * %LOCALAPPDATA%\CodeBuddyExtension\Data\{userId}\JetBrains\{userId}\history\{projectHash}\

8 * ├── index.json # 会话列表

scripts/postinstall.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script - 安装 specpow 后自动注册 hooks 到 AI 工具

5 *

6 * 实现"安装即生效"：

7 * - 检测已安装的 AI 工具（CodeBuddy、Claude Code）

8 * - 自动注册 hooks 到全局配置

9 * - 无需手动运行 specpow init

10 */

12import { existsSync, readFileSync, writeFileSync, mkdirSync }

dist/core/init/engine.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t config = new globalconfigmanager(this.projectroot).load(); const thisfile = fileurltopath(import.meta.url); const packageroot = resolve(thisfile, '..', '..', '..', '..'); const builtindir = join(packageroot, 'builtin'); const srcschemasdir = join(builtindir, 'schemas'); const targetschemasdir = join(this.projectroot, config.paths.schemasdir); if (existssync(srcschemasdir)) { try { const entries = readdirsync(srcschemasdir, { withfiletypes: true }); f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/init/engine.jsView on unpkg

dist/core/init/engine.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/init/engine.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/init/codegraph-step.js

HighShelldist/core/hooks/session-start-hook.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/init/engine.js

HighRuntime Package Installdist/core/init/codegraph-step.js

HighSemantic Analysis Limiteddist/core/init/engine.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to respecpow@0.9.8.

See all versions of respecpow for other recorded verdicts.

Avoid installing respecpow@0.9.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 03:23:53.002Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code