registry / AI-agent control-surface risk / respecpow / 0.9.9

respecpow@0.9.9

Spec-Powered AI Development Framework - 融合 OpenSpec 规范驱动 + Superpowers 执行引擎的企业级 AI 辅助编程框架（安装即生效版）

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The manifest activates a postinstall script that writes behavior-bearing hooks into global AI-agent settings without consent. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm runs the package's postinstall script during installation.

Impact

The commands run during later AI tool events, creating an unconsented control surface in the user's global agent configuration.

Mechanism

The script detects existing CodeBuddy or Claude settings, adds hooks that run respecpow commands, and writes the modified settings without asking the user.

Policy narrative

During package installation, the postinstall script checks for existing CodeBuddy and Claude settings and adds respecpow command hooks to them without asking the user. Those hooks run on later session, prompt, and tool events. This is an unconsented install-time change to global AI-agent control configuration.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.codebuddy/settings.json~/.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js automatically after installation.
The postinstall hook adds command hooks to existing global CodeBuddy and Claude settings, then writes the settings files without a consent check.
The added commands invoke respecpow on session start, prompt submission, and before and after tool use.

Evidence against

The added hook commands invoke this package's own CLI.
No network endpoint or credential collection was identified in the inspected install hook.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 799 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 44-84json

44 },

45 "./command-generation": {

46 "types": "./dist/core/command-generation/index.d.ts",

47 "import": "./dist/core/command-generation/index.js"

48 }

49 },

50 "bin": {

51 "respecpow": "bin/specpow.js"

52 },

53 "engines": {

54 "node": ">=20.19.0"

55 },

56 "scripts": {

57 "build": "node build.js",

58 "dev": "tsc --watch",

59 "test": "vitest run",

60 "test:watch": "vitest",

61 "lint": "eslint src/ --ext .ts",

62 "clean": "rimraf dist",

63 "prepublishOnly": "npm run build",

64 "postinstall": "node scripts/postinstall.js || echo 'Postinstall skipped'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 },

66 "keywords": [

67 "ai",

68 "coding",

69 "spec-driven",

70 "subagent-driven-development",

71 "claude-code",

72 "cursor",

73 "copilot",

74 "workflow",

75 "agent",

76 "skills",

77 "pi-package"

78 ],

79 "files": [

80 "dist/",

81 "bin/",

82 "scripts/",

83 "builtin/schemas/",

84 "builtin/skills/",

dist/core/init/codegraph-step.jsView file

Lines 1-62javascript

1/**

2 * CodeGraph Integration Step

3 *

4 * specpow init 流程中的 CodeGraph 集成步骤：

5 * 1. 检测/安装 codegraph CLI

6 * 2. 映射 SpecPow 检测到的 AI 工具 → codegraph target

7 * 3. 执行 codegraph install --location local

8 * 4. 提醒用户手动运行 codegraph init

9 *

10 * 所有步骤非阻塞，失败仅打印警告。

11 */

dist/core/hooks/session-start-hook.jsView file

Lines 384-424javascript

384 return 'Use `respecpow archive` to merge changes to main specs.';

385 default:

386 return '';

387 }

388}

389// ─── CodeGraph 后台同步 ───────────────────────────────────────

390/**

dist/core/memory/adapters/codebuddy-adapter.jsView file

Lines 4-44javascript

4 * 从 CodeBuddy 的会话存储中读取消息并转换为标准化的 SessionLog 格式

5 *

6 * 存储结构（Windows）：

7 * %LOCALAPPDATA%\CodeBuddyExtension\Data\{userId}\JetBrains\{userId}\history\{projectHash}\

8 * ├── index.json # 会话列表

scripts/postinstall.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script - 安装 specpow 后自动注册 hooks 到 AI 工具

5 *

6 * 实现"安装即生效"：

7 * - 检测已安装的 AI 工具（CodeBuddy、Claude Code）

8 * - 自动注册 hooks 到全局配置

9 * - 无需手动运行 specpow init

10 */

12import { existsSync, readFileSync, writeFileSync, mkdirSync }

dist/core/init/engine.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t config = new globalconfigmanager(this.projectroot).load(); const thisfile = fileurltopath(import.meta.url); const packageroot = resolve(thisfile, '..', '..', '..', '..'); const builtindir = join(packageroot, 'builtin'); const srcschemasdir = join(builtindir, 'schemas'); const targetschemasdir = join(this.projectroot, config.paths.schemasdir); if (existssync(srcschemasdir)) { try { const entries = readdirsync(srcschemasdir, { withfiletypes: true }); f

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/core/init/engine.jsView on unpkg

dist/core/init/engine.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/init/engine.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || echo 'Postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/init/codegraph-step.jsView file

11*/ L12: import { execSync } from 'child_process'; L13: // ============================================================

High

Child Process

Package source references child process execution.

dist/core/init/codegraph-step.jsView on unpkg · L11

Findings

1 Critical6 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/init/codegraph-step.js

HighShelldist/core/hooks/session-start-hook.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/core/init/engine.js

HighRuntime Package Installdist/core/init/codegraph-step.js

HighSemantic Analysis Limiteddist/core/init/engine.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to respecpow@0.9.9.

See all versions of respecpow for other recorded verdicts.

Avoid installing respecpow@0.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 03:24:02.647Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code