starling-ai
Launch, switch, and organize Claude Code and Codex sessions with model profiles, catalogs, project views, and VS Code integration.
This report shows the evidence for starling-ai@0.1.8. 1 of 3 known versions is blocked or flagged. The newest version, 0.5.4, is flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection confirms unconsented lifecycle mutation of Codex/Claude agent skill and hook configuration, which is a concrete publish-block condition even though the CLI behavior itself appears package-aligned. No exfiltration or credential theft was found, so the verdict rests on install-time AI-agent control-surface mutation. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Decision evidence
public snapshot- package.json runs postinstall: node scripts/install-agent-skills.js
- scripts/install-agent-skills.js copies skills/starling/SKILL.md into ~/.codex/skills/starling and ~/.claude/skills/starling
- scripts/install-agent-skills.js modifies ~/.claude/settings.json hooks for multiple Claude events by default
- Hook command runs starling top hook --provider claude on agent events
- STARLING_INSTALL_CLAUDE_HOOK=0 opt-out exists, but no explicit install-time consent gate
- bin/starling.js spawn is user-invoked CLI delegation to platform binary
- No credential harvesting or exfiltration logic found in inspected JS files
- No package runtime network calls found; only repository URL and example API URLs in docs
Source & flagged code
2 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source drops package-supplied AI-agent/MCP control files or instructions.
scripts/install-agent-skills.jsView on unpkg · L2Findings
Affected versions and remediation
This report applies to starling-ai@0.1.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing starling-ai@0.1.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.