registry / @abblor/agent-os / 0.13.2
@abblor/agent-os@0.13.2
Skills, workflows, memory, specs, constitution, hooks, and rules for AI coding agents working on abblor_repos projects.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall mutation is a first-party package-owned agent and Git hook setup, which warrants a warning under the review policy. The inspected source does not establish a concrete malicious action or remote control channel.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The package's postinstall hook runs during npm installation in a consuming repository.
Impact
The package's agent resources and Git hooks become active in the consuming repository without a separate link command.
Mechanism
The CLI links package-owned skills and hooks under .agents and, when a Git directory exists, installs commit-msg and pre-push hooks.
AI rationale
The postinstall mutation is a first-party package-owned agent and Git hook setup, which warrants a warning under the review policy. The inspected source does not establish a concrete malicious action or remote control channel.
Evidence
.agents/skills.agents/constitution.agents/hooks/agent.agents/hooks/git<gitDir>/hooks/commit-msg<gitDir>/hooks/pre-push
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines a postinstall hook that runs the package CLI.
- The postinstall targets the consuming project and calls the package's link routine when the package is installed there.
- The link routine places this package's skills and hooks in the project's .agents directory and installs its commit-msg and pre-push hooks when a Git directory exists.
- The link helper creates symlinks and is documented in source to leave real files and directories untouched.
Evidence against
- The inspected install path links this package's own skills and hooks; it does not show a remote skill channel or unrelated consumer policy edits.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/cli.js postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/cli.js postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgskills/brainstorming/scripts/server.cjsView file
•matchType = normalized_sha256
matchedPackage = @abblor/agent-os@0.11.0
matchedPath = [redacted].cjs
matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.11.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 Critical5 High5 Medium4 Low
CriticalAi Agent Control Hijackbin/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/cli.js
HighKnown Malware Source Similarityskills/writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/brainstorming/scripts/server.cjs
HighPrevious Version Dangerous Deltabin/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/agent/guard-bash.sh
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @abblor/agent-os@0.13.2.
See all versions of @abblor/agent-os for other recorded verdicts.
- Review the evidence and your use of @abblor/agent-os@0.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.