registry / AI-agent control-surface risk / @2p1c/comsol-ai

@2p1c/comsol-ai

Agent skill for COMSOL Multiphysics automation via mph + Java API. Programmatic model creation, parametric/time-domain/frequency studies, and data export. All API patterns verified against COMSOL 6.2.

This report shows the evidence for @2p1c/comsol-ai@1.4.0, the only known version.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package uses an automatic npm lifecycle hook to copy package-controlled skill content into shared and third-party AI-agent directories. This meets the install-time AI-agent control-surface abuse boundary despite no observed secret theft or remote payload execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes postinstall.

Impact

Package-authored instructions become available to multiple AI-agent clients without an explicit setup command.

Mechanism

Automatic recursive deployment into global AI-agent skill directories.

Policy narrative

On npm installation, package.json runs scripts/install-skill.js. The script always creates and populates the shared ~/.agents skill location, then detects and populates several unrelated AI-agent configuration directories. This is an unconsented postinstall mutation of broad agent control surfaces. It also contacts GitHub for an update check unless disabled.

AI rationale

Evidence

package.jsonscripts/install-skill.jsskills/comsol/**~/.agents/skills/comsol~/.claude/skills/comsol~/.cursor/skills/comsol~/.codex/skills/comsol~/.pi/agent/skills/comsol~/.dsh/skills/comsol

Network endpoints1

raw.githubusercontent.com/2p1c/comsol-skills/master/skills/comsol/VERSION

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the installer.
The installer always targets the shared global agent skill directory.
It also writes into detected Claude Code, Cursor, Codex, Pi, and DeepSeek skill locations.
The installer recursively copies the package skill files into those agent control surfaces.
The postinstall performs an outbound version check by default.

Evidence against

No credential collection or secret exfiltration was found.
The remote request reads only a version string and does not execute its response.
No runtime self-dependency, payload download, or obfuscated code was found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 13.7 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"scripts": { "postinstall": "node scripts/install-skill.js", "install-skill": "node scripts/install-skill.js", "check-update": "node skills/comsol/scripts/check-update.js",

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the installer.

package.jsonView on unpkg · L33

scripts/check-version-sync.jsView file

3L4: const fs = require('fs'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-version-sync.jsView on unpkg · L3

scripts/install-skill.jsView file

4* L5: * Always copies to ~/.agents/skills/comsol (shared convention). L6: * Also copies to an agent's native global path when that agent is detected. ... L39: function copyDir(src, dst) { L40: fs.mkdirSync(dst, { recursive: true }); L41: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L47: } else { L48: fs.copyFileSync(srcPath, dstPath); L49: } ... L58: detect: true, L59: dir: path.join(home, '.agents', 'skills', SKILL_NAME), L60: },

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.jsView on unpkg · L4

examples/animate_results.pyView file

•path = examples/animate_results.py kind = build_helper sizeBytes = 5772 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/animate_results.pyView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"scripts": { "postinstall": "node scripts/install-skill.js", "install-skill": "node scripts/install-skill.js", "check-update": "node skills/comsol/scripts/check-update.js",

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the installer.

package.jsonView on unpkg · L33

scripts/check-version-sync.jsView file

3L4: const fs = require('fs'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-version-sync.jsView on unpkg · L3

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/install-skill.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumDynamic Requirescripts/check-version-sync.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperexamples/animate_results.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @2p1c/comsol-ai@1.4.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @2p1c/comsol-ai@1.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 12:00:34.286Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.4.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 10, 2026, 3:53 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code