talking-stick@0.16.0
Talking Stick now ships as a standalone binary. Install with: curl -fsSL https://raw.githubusercontent.com/mostlydev/talking-stick/master/scripts/install.sh | sh Put ~/.local/bin first on PATH, then remove the npm copy. Existing installs remain functional; future updates ship on GitHub.
CLI coordination tool for path-scoped agent handoffs.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe install hook stages an external executable without independent signature verification, creating a real but unresolved payload risk. The inspected source does not show concrete attack behavior, so this warrants a warning rather than a block.
Decision evidence
public snapshot- package.json declares a postinstall hook that runs scripts/postinstall.cjs.
- The postinstall hook runs the Skiller bootstrap for installed copies under node_modules/talking-stick.
- The bootstrap fetches a release checksum file and archive from a configurable URL, then checks the archive against that fetched checksum.
- It installs the extracted binary in the configured install directory, which defaults to the user's home bin directory, and invokes it to read its version.
- The inspected agent configuration path maps harnesses to their own home configuration directories.
- The downloaded archive is checked against a checksum fetched from the same release base; no independent signature verification is shown.
- The postinstall code treats bootstrap failure as nonfatal by default.
- The inspected bootstrap invokes the installed binary only with the version command.
Source & flagged code
15 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
dist/process-utils.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to talking-stick@0.16.0.
See all versions of talking-stick for other recorded verdicts.
- Review the evidence and your use of talking-stick@0.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.