registry / @2p1c/comsol-ai / 1.4.0

@2p1c/comsol-ai@1.4.0

Agent skill for COMSOL Multiphysics automation via mph + Java API. Programmatic model creation, parametric/time-domain/frequency studies, and data export. All API patterns verified against COMSOL 6.2.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically places its agent skill in a shared global directory and in detected third-party AI-agent directories. It also performs a default outbound update check.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes postinstall.

Impact

Package-authored instructions become available to multiple AI-agent clients without an explicit setup command.

Mechanism

Automatic recursive deployment into global AI-agent skill directories.

Policy narrative

On npm installation, package.json runs scripts/install-skill.js. The script always creates and populates the shared ~/.agents skill location, then detects and populates several unrelated AI-agent configuration directories. This is an unconsented postinstall mutation of broad agent control surfaces. It also contacts GitHub for an update check unless disabled.

AI rationale

The package uses an automatic npm lifecycle hook to copy package-controlled skill content into shared and third-party AI-agent directories. This meets the install-time AI-agent control-surface abuse boundary despite no observed secret theft or remote payload execution.

Evidence

package.jsonscripts/install-skill.jsskills/comsol/**~/.agents/skills/comsol~/.claude/skills/comsol~/.cursor/skills/comsol~/.codex/skills/comsol~/.pi/agent/skills/comsol~/.dsh/skills/comsol

Network endpoints

@2p1c/comsol-ai@1.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code