registry / starling-ai / 0.5.4
starling-ai@0.5.4
Launch, switch, and organize Claude Code, Codex, and Pi sessions with model profiles, catalogs, project views, and VS Code integration.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall performs user-level agent setup without a separate affirmative setup command, including Claude hooks that run during multiple agent events. The inspected source supports a first-party integration warning but does not establish a concrete attack or remote disclosure.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the npm package triggers postinstall setup.
Impact
Future agent activity can invoke Starling commands and the Pi reporter can record session metadata locally; the inspected source does not show that this metadata leaves the machine.
Mechanism
The installer copies files into user-level agent directories and adds Claude hooks for session and tool events unless disabled by an environment variable.
AI rationale
The postinstall performs user-level agent setup without a separate affirmative setup command, including Claude hooks that run during multiple agent events. The inspected source supports a first-party integration warning but does not establish a concrete attack or remote disclosure.
Evidence
package.jsonscripts/install-agent-skills.jsvendor/pi-reporter.ts.claude/settings.json.pi/agent/extensions/starling-reporter.ts
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs the agent setup script automatically during postinstall.
- The installer copies skills into user-level Codex, Claude, and Pi directories and installs a Pi reporter extension; the Pi installation has an environment-variable opt-out.
- Unless an environment variable disables it, the installer adds command hooks to Claude settings for eight session and tool events.
- The packaged Pi reporter stores session identifiers, transcript paths, working directories, and model names locally, then sends a session summary to a local Starling command. The inspected source does not establish external transfer.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agent-skills.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg33"scripts": {
"postinstall": "node scripts/install-agent-skills.js"
},
"repository": {
"type": "git",
"url": "https://github.com/huang-sh/Starl
Medium
Suspicious Lifecycle Evidence
package.json runs the agent setup script automatically during postinstall.
package.jsonView on unpkg · L33bin/starling.jsView file
3L4: import { spawn } from "node:child_process";
L5: import { existsSync, readFileSync, realpathSync } from "fs";
High
Findings
1 Critical3 High5 Medium3 Low
CriticalAi Agent Control Hijackscripts/install-agent-skills.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/starling.js
HighSame File Env Network Executionlib/agents/pi/sdk-adapter.js
MediumDynamic Requirelib/agents/pi/sdk-adapter.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to starling-ai@0.5.4.
See all versions of starling-ai for other recorded verdicts.
- Review the evidence and your use of starling-ai@0.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.