@agent-qofeno/agentx-cli@2.0.6
The AI agent that builds production-ready websites from your terminal
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe package ships a postinstall-style script that would remotely install agent skills through npx, but that script is not registered as an npm lifecycle hook and is not called by the CLI. Because the remote-execution payload is present yet inactive, this is an inert carrier rather than a confirmed install attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The script would run only if a later release or a person explicitly executes scripts/postinstall.js. Current npm install and the agentx bin do not call it.
Impact
If activated, it could install third-party agent skills and execute their installers on the machine. As shipped, install and normal CLI use do not reach that code.
Mechanism
tryInstallSkill passes repository URLs into execSync as npx skills add arguments, which would fetch and execute those skill packages if the script were started.
AI rationale
The package ships a postinstall-style script that would remotely install agent skills through npx, but that script is not registered as an npm lifecycle hook and is not called by the CLI. Because the remote-execution payload is present yet inactive, this is an inert carrier rather than a confirmed install attack.
Evidence
scripts/postinstall.js
Network endpoints2
github.com/sohailkhan0525/skillsgithub.com/nextlevelbuilder/ui-ux-pro-max-skill
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- scripts/postinstall.js shells out with execSync to npx skills add, which would download and run remote skill installers.
- That installer targets two GitHub skill repositories, including a third-party repository.
- The script is published in the package files list, but package.json defines no preinstall, install, or postinstall hook, and dist/index.js never calls it.
Evidence against
- npm install does not execute scripts/postinstall.js because no lifecycle script references it.
- The published CLI entry only renders a terminal UI; its message handler is an empty function and does not spawn processes or send credentials.
- No credential harvesting, exfiltration, or self-dependency install chain appears in the active entrypoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/index.jsView file
30785function wrapAnsi(string, columns, options) {
L30786: return String(string).normalize().replace(/\r\n/g, "\n").split("\n").map((line) => exec(line, columns, options)).join("\n");
L30787: }
High
scripts/postinstall.jsView file
6console.log('Installing skill:', skill)
L7: execSync(`npx skills add ${repo} ${skill}`, {
L8: stdio: 'pipe', timeout: 60000
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/postinstall.jsView on unpkg · L6dist/yoga.wasmView file
•path = dist/yoga.wasm
kind = wasm_module
sizeBytes = 88658
magicHex = [redacted]
Findings
3 High5 Medium6 Low
HighChild Processdist/index.js
HighShell
HighRuntime Package Installscripts/postinstall.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/yoga.wasm
MediumShips Build Helperscripts/setup-homebrew-tap.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @agent-qofeno/agentx-cli@2.0.6.
See all versions of @agent-qofeno/agentx-cli for other recorded verdicts.
- Review the evidence and your use of @agent-qofeno/agentx-cli@2.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.