HokiPoki

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:47 AM UTC
• Version: 1.0.0

Overview

The skill is a documented AI-routing helper, but it asks users to install and trust a global CLI that can send large portions of a project externally, auto-apply patches, and weaken Codex sandbox protections.

Review this carefully before installing. Use the narrowest file selection possible, avoid --all unless you have checked for secrets and proprietary content, prefer --no-auto-apply and manual patch review, avoid making .git writable in Codex unless temporarily required, and consider pinning or independently reviewing the CLI before using it with sensitive repositories or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party CLI Has Repository Access and Patch-Application Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g @next-halo/hokipoki-cli
hokipoki login

Related high-impact capabilities are documented at SKILL.md, lines 29–50:

bash

# Specific files
hokipoki request --tool claude --task "Fix the auth bug" --files src/auth.ts --json

# Entire directory
hokipoki request --tool codex --task "Add error handling" --dir src/services/ --json

# Whole project (respects .gitignore)
hokipoki request --tool gemini --task "Review for security issues" --all --json

# Route to a team workspace
hokipoki request --tool claude --task "Optimize queries" --files src/db.ts --workspace my-team --json

# Skip auto-apply (just save the patch)
hokipoki request --tool codex --task "Refactor module" --dir src/ --no-auto-apply --json

The documentation further states:

text

Patches auto-apply when the target directory is a git repo with committed files.

Technical Analysis

The installation command retrieves the latest available version of @next-halo/hokipoki-cli without an exact version, integrity hash, lockfile, or other reproducibility control. It installs the package globally, and the resulting executable runs with the invoking user's privileges.

The installed CLI is subsequently entrusted with sensitive operations: authenticating the user, reading specified files or an entire repository, transmitting those materials to remote AI providers, and automatically applying returned patches. Consequently, a compromised package release, registry account, transitive dependency, or unexpectedly changed upstream version could abuse the same access granted for legitimate operation.

The audited package contains only documentation, so the claimed encryption, container isolation, credential handling, and data-retention properties cannot ...[truncated 1614 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed exact version rather than installing an unconstrained latest release.
2. Publish and verify package integrity information, such as a trusted checksum, signature, or npm integrity value.
3. Provide a verifiable link to the corresponding source revision and document a reproducible review process.
4. Prefer a project-local, locked dependency or an isolated execution environment over a global installation.
5. Disable patch auto-application by default. Save patches for explicit human review and approval before modifying the working tree.
6. Default to an explicit allowlist of files. Require informed confirmation before transmitting directories or an entire repository.
7. Add preflight secret scanning and clearly warn users that ignored files, generated artifacts, and tracked configuration may contain sensitive information.
8. Run the CLI with least privilege and restrict its filesystem and network access to what each request requires.
9. Independently assess the CLI implementation and its transitive dependencies before relying on its encryption, isolation, token-handling, and data-deletion claims.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The documentation instructs users to modify ~/.codex/config.toml to make .git writable inside the Codex sandbox. Allowing writes to .git weakens an important isolation boundary because a model or tool operating in the sandbox could alter hooks, config, refs, or repository metadata in ways that persist outside normal source-file changes and are harder to detect.

Content

Scanner excerpt · references/commands.md (reported line 65)May include surrounding context.

Codex Sandbox Fix

Codex blocks .git/ writes by default. Add to ~/.codex/config.toml:

toml

[sandbox_workspace_write]

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad natural-language phrases such as 'ask another AI', 'get a second opinion', and 'switch models', which can match ordinary user intent too loosely and cause unintended activation. In a skill that can transmit prompts and files to external tools and peers, accidental invocation increases the chance of unintended data disclosure or unauthorized routing of work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to send tasks, directories, and even the whole project to remote AI models, but it does not present an explicit warning that code, prompts, or other data will leave the local environment. Because the skill supports sending entire directories or all project files and uses a P2P/provider model, users may unknowingly disclose sensitive source code, secrets, or proprietary information to external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The command reference explicitly documents sending task text and optionally specific files, directories, or the entire repository to another AI tool or workspace, but it does not include any warning about data disclosure, scope review, or privacy implications. In a skill whose purpose is to relay code and requests across providers and teammates, this omission increases the chance that users or agents transmit sensitive source code, secrets, or proprietary data unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.