Loading npm security reports…

@abblor/agent-os@0.11.0: AI-agent control-surface risk | LPM Firewall

registry / @abblor/agent-os / 0.11.0

@abblor/agent-os@0.11.0

Skills, workflows, memory, specs, constitution, hooks, and rules for AI coding agents working on abblor_repos projects.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall mutates the consuming project’s .agents control surface without an explicit command. It also installs persistent Git hooks when the target is a repository.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of the package in a consuming project

Impact

Package-supplied agent instructions and hook behavior become active in the consumer repository.

Mechanism

postinstall symlinks agent skills/hooks and Git hooks into the consumer project

Policy narrative

Installing the package automatically calls its CLI against INIT_CWD. The CLI creates consumer-project .agents links to packaged skills and agent hooks, and in Git repositories links packaged commit-msg and pre-push hooks into .git/hooks. This is unconsented install-time mutation of a foreign project’s AI-agent control surface and persistent repository behavior.

Rationale

The lifecycle hook concretely modifies consumer AI-agent and Git control paths, rather than merely exposing an explicit setup command. No exfiltration was found, but the unconsented postinstall control-surface mutation meets the blocking policy.

Evidence

package.jsonbin/cli.jshooks/agent/session-start.shhooks/git/commit-msghooks/git/pre-push.agents/skills/*.agents/constitution.agents/hooks/agent.agents/hooks/git

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.10.0 matchedPath = [redacted].cjs matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BRAINSTORM_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BRAINSTORM_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/brainstorming/scripts/server.cjsView on unpkg · L1

bin/cli.jsView file

18Symlink shared skills/, hooks/, and constitution/ from this package L19: into <target>/.agents/. Safe to re-run (idempotent); never touches L20: real (non-symlink) files or directories already there. ... L28: agent-os check [--target <dir>] L29: Verify a consuming repo's .agents/ wiring and exit non-zero if it is L30: broken. Checks that the four mandatory files are readable, that no L31: symlink under .agents/ dangles, that every installed skill is L32: mentioned in SKILL_INDEX.md, and that the index never routes to a ... L127: } L128: fs.mkdirSync(path.dirname(destPath), { recursive: true }); L129: fs.symlinkSync(relative, destPath, 'dir'); ... L155: /** Install one git hook as a symlink into <gitDir>/hooks/<hookName>,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L18

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. fs.readlinksync(destpath); if (current === relative) { if (!quiet) console.log(` = ${path.relative(process.cwd(), destpath)} (already linked)`); return 'unchanged'; } fs.unlinksync(destpath); fs.symlinksync(relative, destpath, 'dir'); if (!quiet) console.log(` ~ ${path.relative(process.cwd(), destpath)} (relinked)`); return 'relinked'; } console.warn( ` ! ${path.relative(process.cwd(), destpath)} exists and is not a symlink — leaving it alone.` ); return 'skipped'; } fs.mkdirsync(path.dirname(destpath), { recursive: true }); fs.symlinksync(relative, destpath, 'dir'); if (!quiet) console.log(` +

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

hooks/agent/guard-bash.shView file

•path = hooks/agent/guard-bash.sh kind = build_helper sizeBytes = 5621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/agent/guard-bash.shView on unpkg

skills/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.10.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/writing-skills/render-graphs.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 963f3de70457a881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @abblor/agent-os@0.10.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.10.0 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

skills/writing-skills/render-graphs.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "@abblor/agent-os",

3 "version": "0.11.0",

4 "description": "Skills, workflows, memory, specs, constitution, hooks, and rules for AI coding agents working on abblor_repos projects.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "agent-os": "bin/cli.js"

9 },

10 "scripts": {

11 "test": "node --test",

12 "postinstall": "node bin/cli.js postinstall"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "files": [

15 "bin",

16 "skills",

17 "workflows",

18 "constitution",

19 "rules",

20 "specs",

21 "memory",

22 "hooks",

23 "ci",

24 "README.md",

25 "NOTICE.md",

26 "LICENSE",

27 "CHANGELOG.md"

28 ],

29 "publishConfig": {

30 "access": "public"

31 },

32 "engines": {

skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

bin/cli.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// @abblor/agent-os CLI — `link` and `init` subcommands.

3// Pure Node core modules only, no dependencies, so the package stays tiny.

4

5import fs from 'node:fs';

6import path from 'node:path';

7import readline from

hooks/agent/guard-bash.shView file

•path = hooks/agent/guard-bash.sh kind = build_helper sizeBytes = 5621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/agent/guard-bash.shView on unpkg

skills/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.10.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/writing-skills/render-graphs.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 963f3de70457a881 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @abblor/agent-os@0.10.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.10.0 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

skills/writing-skills/render-graphs.jsView on unpkg