@abblor/agent-os@0.12.0
Skills, workflows, memory, specs, constitution, hooks, and rules for AI coding agents working on abblor_repos projects.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest activates a postinstall handler that mutates the consumer project’s agent configuration and Git hooks without confirmation. This is an unconsented install-time agent control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package in a consuming project runs its postinstall script.
Impact
Package-provided agent instructions and hooks become active in the consumer project without a separate user command.
Mechanism
The handler calls the linker, which creates entries under .agents and installs commit-msg and pre-push hooks.
Policy narrative
On package installation, postinstall targets the consuming project and calls the linker. The linker installs package-provided skills and hooks under .agents and installs Git hooks when it finds a Git directory. This creates an active agent control surface without a separate user command.
AI rationale
The manifest activates a postinstall handler that mutates the consumer project’s agent configuration and Git hooks without confirmation. This is an unconsented install-time agent control-surface mutation.
Evidence
package.jsonbin/cli.js.agents/skills.agents/constitution.agents/hooks/agent.agents/hooks/git<git-dir>/hooks/commit-msg<git-dir>/hooks/pre-push
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- The package manifest runs a postinstall command automatically.
- The postinstall handler targets the consuming project and calls link without a user confirmation step.
- Link creates .agents/skills entries from package content and installs commit-msg and pre-push hooks when a Git directory exists.
Evidence against
- The linker skips the package’s own workspace and does not replace existing real files or directories.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/cli.js postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/cli.js postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgskills/brainstorming/scripts/server.cjsView file
•matchType = normalized_sha256
matchedPackage = @abblor/agent-os@0.11.0
matchedPath = [redacted].cjs
matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.11.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 Critical5 High5 Medium4 Low
CriticalAi Agent Control Hijackbin/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/cli.js
HighKnown Malware Source Similarityskills/writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/brainstorming/scripts/server.cjs
HighPrevious Version Dangerous Deltabin/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/agent/guard-bash.sh
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @abblor/agent-os@0.12.0.
See all versions of @abblor/agent-os for other recorded verdicts.
- Avoid installing @abblor/agent-os@0.12.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.