registry / @agent-qofeno/agentx-cli / 2.0.2

@agent-qofeno/agentx-cli@2.0.2

The AI agent that builds production-ready websites from your terminal

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation automatically invokes a shell command to add AI skills from external repositories. This mutates an AI-agent skill/control surface without an explicit user setup command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation

Impact

Installs externally supplied AI-agent skills, allowing third-party instructions/capabilities to affect compatible agent environments.

Mechanism

execSync runs npx skills add for remote repositories

Policy narrative

Installing the package triggers scripts/postinstall.js automatically. That script shells out to `npx skills add` twice, sourcing skills from external GitHub repositories; failures are caught and hidden as skipped installs. This is an unconsented install-time mutation of an AI-agent skill/control surface, rather than an explicit user-invoked setup action.

Rationale

The package’s postinstall hook performs remote third-party AI-skill installation through a shell command. This satisfies the policy’s concrete unconsented install-time foreign AI-agent control-surface mutation threshold.

Evidence

package.jsonscripts/postinstall.js

Network endpoints2

github.com/sohailkhan0525/skillsgithub.com/nextlevelbuilder/ui-ux-pro-max-skill

@agent-qofeno/agentx-cli@2.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code