Loading npm security reports…

@abarcenas/ai-workflow-template: AI-agent control-surface risk | LPM Firewall

registry / @abarcenas/ai-workflow-template / 1.45.0

@abarcenas/ai-workflow-template@1.45.0

A comprehensive template repository for AI-assisted development workflows using GitHub Copilot. This template provides a structured approach to leveraging AI assistance through pre-configured skills, prompts, agents, and coding standards.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically alters the consumer’s AI-agent configuration and project files. It installs agent instructions and OpenCode agents, then can create an enabled MCP configuration with broad tool permissions.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

A dependency installation can establish package-selected agent behavior, tool permissions, and a remote MCP channel without an explicit setup command.

Mechanism

Automatic copying of AI-agent control files and consumer-project normalization.

Policy narrative

On installation, postinstall invokes sync.js against the consumer directory. That script populates .agents and .opencode with package-controlled instructions and agents, and creates opencode.json when it is absent. The resulting configuration enables a remote MCP service and broad allow rules. The same automatic lifecycle also normalizes and migrates consumer documentation. This is an unconsented install-time mutation of a broad AI-agent control surface.

AI rationale

The package performs unconsented postinstall mutation of consumer AI-agent configuration, including an enabled remote MCP channel and broad permissions. This meets the install-control-surface block policy even though no direct credential exfiltration was found.

Evidence

package.jsonscripts/sync.jsopencode.mcp.example.jsonscripts/normalize-memory.js.agents/.opencode/AGENTS.mdopencode.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/sync.js && node ./scripts/normalize-memory.js && echo '' && echo '⚠️ IMPORTANT: Run npx ai-workflow-setup to configure git hooks' && echo ' (npm postinstall scrip...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/sync.js && node ./scripts/normalize-memory.js && echo '' && echo '⚠️ IMPORTANT: Run npx ai-workflow-setup to configure git hooks' && echo ' (npm postinstall scrip...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup/husky-init.jsView file

75try { L76: const consumerRequire = createRequire(join(consumerRoot, 'package.json')) L77: const huskyPath = consumerRequire.resolve('husky')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/setup/husky-init.jsView on unpkg · L75

scripts/sync.jsView file

1import { createHash } from 'crypto' L2: import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs' L3: import { dirname, join, relative, resolve } from 'path' ... L7: const packageRoot = resolve(__dirname, '..') L8: const sourceAgentsDir = resolve(packageRoot, '.agents') L9: const consumerRoot = process.env.INIT_CWD ? resolve(process.env.INIT_CWD) : process.cwd() L10: const targetAgentsDir = resolve(consumerRoot, '.agents') L11: const manifestPath = resolve(consumerRoot, '.agents-sync-manifest.json') L12: const excludedRelativePaths = new Set([ ... L65: function writeManifest(manifest) { L66: writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`) L67: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/sync.jsView on unpkg · L1

.agents/skills/compress/scripts/benchmark.pyView file

•path = .[redacted].py kind = payload_in_excluded_dir sizeBytes = 2264 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/compress/scripts/benchmark.pyView on unpkg

•path = .[redacted].py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/compress/scripts/benchmark.pyView on unpkg

scripts/knowledgebase-index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/knowledgebase-index.js#virtual:normalized:round1View on unpkg

scripts/bump-version.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @abarcenas/ai-workflow-template@1.34.0 matchedIdentity = npm:[redacted]:1.34.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/bump-version.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "@abarcenas/ai-workflow-template",

3 "version": "1.45.0",

4 "description": "A comprehensive template repository for AI-assisted development workflows using GitHub Copilot. This template provides a structured approach to leveraging AI assistance through pre-configured skills, prompts, agents, and coding standards.",

5 "main": "index.js",

6 "bin": {

7 "ai-workflow-setup": "./bin/setup.js"

8 },

9 "scripts": {

10 "test": "playwright test",

11 "test:headed": "playwright test --headed",

12 "test:ui": "playwright test --ui",

13 "test:debug": "playwright test --debug",

14 "test:report": "playwright show-report",

15 "test:unit": "vitest run",

16 "test:unit:coverage": "vitest run --coverage",

17 "test:unit:watch": "vitest",

18 "prepare": "husky",

19 "sync": "node ./scripts/sync.js",

20 "postinstall": "node ./scripts/sync.js && node ./scripts/normalize-memory.js && echo '' && echo '⚠️ IMPORTANT: Run npx ai-workflow-setup to configure git hooks' && echo ' (npm postinstall scripts will be blocked by npm v12+)'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "memory:search": "node ./scripts/memory-cli.js search",

22 "memory:rebuild": "node ./scripts/memory-cli.js rebuild",

23 "memory:update": "node ./scripts/memory-cli.js update",

24 "memory:normalize": "node ./scripts/normalize-memory.js",

25 "kb:sync": "node ./scripts/knowledgebase-cli.js sync",

26 "kb:search": "node ./scripts/knowledgebase-cli.js search",

27 "kb:stats": "node ./scripts/knowledgebase-cli.js stats"

28 },

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/abarcenas29/ai-workflow-template.git"

32 },

33 "keywords": [],

34 "author": "",

35 "license": "ISC",

36 "type": "module",

37 "bugs": {

38 "url": "https://github.com/abarcenas29/ai-workflow-template/issues"

39 },

40 "homepage": "https://github.com/abarcenas29/ai-workflow-template#readme",

scripts/setup/husky-init.jsView file

Lines 55-95javascript

55 if (isCI) {

56 warn('[setup] CI environment detected — skipping husky init')

57 return {

58 action: 'skipped',

59 message: 'Skipping husky init in CI environment',

60 }

61

scripts/sync.jsView file

Lines 1-21javascript

1import { createHash } from 'crypto'

2import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs'

3import { dirname, join, relative, resolve } from 'path'

4import { fileURLToPath } from 'url'

5

6

.agents/skills/compress/scripts/benchmark.pyView file

•path = .[redacted].py kind = payload_in_excluded_dir sizeBytes = 2264 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/compress/scripts/benchmark.pyView on unpkg

•path = .[redacted].py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/compress/scripts/benchmark.pyView on unpkg

scripts/knowledgebase-index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/knowledgebase-index.js#virtual:normalized:round1View on unpkg

scripts/bump-version.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @abarcenas/ai-workflow-template@1.34.0 matchedIdentity = npm:[redacted]:1.34.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/bump-version.jsView on unpkg