registry / talking-stick / 0.23.0
talking-stick@0.23.0
Talking Stick now ships as a standalone binary. Install with: curl -fsSL https://raw.githubusercontent.com/mostlydev/talking-stick/master/scripts/install.sh | sh Put ~/.local/bin first on PATH, then remove the npm copy. Existing installs remain functional; future updates ship on GitHub.
CLI coordination tool for path-scoped agent handoffs.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe lifecycle behavior is a package-aligned setup for a named companion tool, with archive hash and version checks. The flagged runtime, agent-sync, and process-management paths showed no concrete attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The npm postinstall continues when the package is installed under node_modules/talking-stick and its CLI exists; the bootstrap exits if disabled or a usable companion binary is already present.
Impact
No harmful effect was established. The inspected runtime operations concern chat and role workflows, while process shutdown is limited by a recorded process start time.
Mechanism
The bootstrap downloads a Skiller archive and checksum from the same release base, verifies the archive hash, installs the executable in the user-local bin directory, and checks its version.
AI rationale
The lifecycle behavior is a package-aligned setup for a named companion tool, with archive hash and version checks. The flagged runtime, agent-sync, and process-management paths showed no concrete attack behavior.
Evidence
package.jsonscripts/postinstall.cjsscripts/skiller-bootstrap.cjs~/.local/bin/skiller
Network endpoints1
github.com/mostlydev/skiller/releases/download/v0.1.0
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest runs postinstall, which continues only when the package is under node_modules/talking-stick and its CLI file exists.
- The bootstrap defaults to the mostlydev/skiller v0.1.0 release and a user-local bin directory; its release URL can be overridden through the environment.
- The bootstrap skips when disabled or a usable binary exists, checks the archive against checksums fetched from the same release base, installs it, and checks its version.
- The postinstall sync handles existing skill and instruction locations; instruction updates skip missing files and preserve customized content. Harness configuration paths map to known user-level locations.
- The flagged runtime locations handle room selection, terminal output, role display and user-directed role changes; chat input forwards submitted text to its handler. No unrequested account action was identified.
- Guardian shutdown uses a recorded process ID and start time, and the process helper checks that start time before sending a signal.
Evidence against
Behavioral surface
ChildProcess
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/process-utils.jsView file
1import { execFileSync } from "node:child_process";
L2: export function terminateKnownProcess(processRef, options) {
High
Child Process
Package source references child process execution.
dist/process-utils.jsView on unpkg · L1Findings
7 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/process-utils.js
HighShelldist/instructions.js
HighSame File Env Network Executionscripts/skiller-bootstrap.cjs
HighSemantic Analysis Limiteddist/cli/chat-input.js#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/skiller-bootstrap.cjs
HighPrevious Version Dangerous Deltadist/cli/guardian.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to talking-stick@0.23.0.
See all versions of talking-stick for other recorded verdicts.
- Review the evidence and your use of talking-stick@0.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.