talking-stick@0.15.0
Talking Stick now ships as a standalone binary. Install with: curl -fsSL https://raw.githubusercontent.com/mostlydev/talking-stick/master/scripts/install.sh | sh Put ~/.local/bin first on PATH, then remove the npm copy. Existing installs remain functional; future updates ship on GitHub.
CLI coordination tool for path-scoped agent handoffs.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe npm postinstall hook performs first-party agent skill setup and installs a companion binary, creating an automatic agent-extension lifecycle risk. The inspected code does not establish a concrete attack, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The package runs a postinstall script that bootstraps a companion binary and synchronizes bundled skills and instructions.
- Postinstall downloads a Skiller archive and its checksum from the same configurable GitHub release base, then installs the binary under the user’s local bin directory.
- The automatic sync targets harness skill directories; the installer also resolves configuration directories for supported agent harnesses.
- The cited install code identifies those harness configuration directories; this location alone does not establish an attack.
- The postinstall script exits unless the package is under node_modules/talking-stick and its CLI exists.
- The checksum is compared with the downloaded archive before installation, and the downloaded binary is checked for a minimum version.
- Instruction updates skip missing files and inspect existing content before deciding whether to change it.
Source & flagged code
15 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dist/process-utils.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to talking-stick@0.15.0.
See all versions of talking-stick for other recorded verdicts.
- Review the evidence and your use of talking-stick@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.