@andy-toolforge/ba-support
Toolforge domain: Business analysis support — competitor analysis, SWOT, pricing analysis, market trends, report generation
This report shows the evidence for @andy-toolforge/ba-support@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiAlthough the planted skills are business-analysis aligned and no exfiltration was found, the package automatically writes AI-agent control files into the consumer project during postinstall. Under the install control-surface policy, unconsented lifecycle mutation of a broad/foreign agent skill surface is blockable.
Decision evidence
public snapshot- package.json defines postinstall: node skills/postinstall.js
- skills/postinstall.js creates .opencode/skills under install cwd
- postinstall symlinks or copies package markdown skills into that agent skill directory
- Lifecycle mutation is automatic and not guarded by opt-in or existing platform extension path
- No credential/env harvesting found
- No network calls or remote payload fetches found
- Runtime lib/researcher.js is package-aligned LLM business-analysis functionality
Source & flagged code
3 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @andy-toolforge/ba-support@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @andy-toolforge/ba-support@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.