registry / AI-agent control-surface risk / @andy-toolforge/ba-support

@andy-toolforge/ba-support

Toolforge domain: Business analysis support — competitor analysis, SWOT, pricing analysis, market trends, report generation

This report shows the evidence for @andy-toolforge/ba-support@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Although the planted skills are business-analysis aligned and no exfiltration was found, the package automatically writes AI-agent control files into the consumer project during postinstall. Under the install control-surface policy, unconsented lifecycle mutation of a broad/foreign agent skill surface is blockable.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install lifecycle postinstall

Impact

Consumer projects receive agent instructions without explicit user opt-in, altering a broad AI-agent control surface.

Mechanism

unconsented lifecycle creation of AI-agent skill files

Policy narrative

On install, npm runs skills/postinstall.js. The script uses process.cwd() as the project root, creates .opencode/skills, then symlinks or copies every package markdown skill into that directory with a ba-support prefix. This is an automatic write into an AI-agent skill/control surface, not a user-invoked setup step.

AI rationale

Evidence

package.jsonskills/postinstall.jsskills/ba-requirement-gatherer.mdskills/ba-competitor-analysis.md.opencode/skills/ba-support-ba-requirement-gatherer.md.opencode/skills/ba-support-ba-competitor-analysis.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.

Evidence for policy risk

package.json defines postinstall: node skills/postinstall.js
skills/postinstall.js creates .opencode/skills under install cwd
postinstall symlinks or copies package markdown skills into that agent skill directory
Lifecycle mutation is automatic and not guarded by opt-in or existing platform extension path

Evidence against

No credential/env harvesting found
No network calls or remote payload fetches found
Runtime lib/researcher.js is package-aligned LLM business-analysis functionality

Behavioral surface

Source

Filesystem

Supply chain

UrlStrings

Manifest

NoLicense

scanned 5 file(s), 24.7 KB of source, external domains: example.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-18json

2 "name": "@andy-toolforge/ba-support",

3 "version": "1.0.1",

4 "description": "Toolforge domain: Business analysis support — competitor analysis, SWOT, pricing analysis, market trends, report generation",

5 "main": "lib/index.js",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/andy-pham-it/toolforge.git"

9 },

10 "scripts": {

11 "postinstall": "node skills/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "test": "node --test lib/*.test.js"

13 },

14 "dependencies": {

15 "@andy-toolforge/core": "^1.0.0"

16 }

17}

skills/postinstall.jsView file

Lines 1-25javascript

1const fs = require('fs');

2const path = require('path');

4const DOMAIN =

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node skills/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node skills/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/postinstall.jsView file

5Install-time AI-agent control hijack evidence: L5: const projectRoot = process.cwd(); L6: const targetDir = path.join(projectRoot, '.opencode', 'skills'); L7: const sourceDir = path.join(__dirname); L8: L9: fs.mkdirSync(targetDir, { recursive: true }); L10: ... L20: } catch (e) { L21: fs.copyFileSync(src, dest); L22: console.log(` 📄 Copied ${destName}`); Payload evidence from AGENTS.md: L15: swot-analyzer.md L16: package.json — deps: @andy-toolforge/core L17: ```

Critical

Findings

1 Critical1 High2 Medium4 Low

CriticalAi Agent Control Hijackskills/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @andy-toolforge/ba-support@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @andy-toolforge/ba-support@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-05 02:09:24.628Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.1latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 5, 2026, 2:00 AM 1.0.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 1, 2026, 10:08 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @andy-toolforge

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

More from @andy-toolforge

Other AI-agent control-surface risk packages

Source & flagged code