registry / AI-agent control-surface risk / @andy-toolforge/content-operations
@andy-toolforge/content-operations
Toolforge domain: content operations — research, plan, create, distribute, analyze
This report shows the evidence for @andy-toolforge/content-operations@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection confirms unconsented npm lifecycle mutation of a project AI-agent skill surface, which matches the firewall policy for ai_agent_control_hijack. No additional credential theft or exfiltration was found, but those are not required for this block category.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / postinstall
Impact
A consuming project receives package-supplied OpenCode skills without an explicit user action, changing agent behavior in that project.
Mechanism
unconsented lifecycle write of AI-agent skill files
Policy narrative
On npm install, package.json invokes skills/postinstall.js. That script creates .opencode/skills under the current project and symlinks or copies package-authored markdown skills there, registering agent-facing instructions without a separate opt-in step. The skill content is content-operations oriented, but the lifecycle-triggered mutation of a broad project AI-agent control surface is the blockable behavior.
AI rationale
Static inspection confirms unconsented npm lifecycle mutation of a project AI-agent skill surface, which matches the firewall policy for ai_agent_control_hijack. No additional credential theft or exfiltration was found, but those are not required for this block category.
Evidence
package.jsonskills/postinstall.jsskills/blog-writing.mdskills/content-repurposing.mdskills/editorial-calendar.mdskills/performance-analysis.mdskills/script-writing.mdskills/seo-optimization.mdskills/trend-discovery.md.opencode/skills/content-operations-blog-writing.md.opencode/skills/content-operations-content-repurposing.md.opencode/skills/content-operations-editorial-calendar.md.opencode/skills/content-operations-performance-analysis.md.opencode/skills/content-operations-script-writing.md.opencode/skills/content-operations-seo-optimization.md.opencode/skills/content-operations-trend-discovery.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall: node skills/postinstall.js
- skills/postinstall.js uses process.cwd() and creates .opencode/skills during npm install
- postinstall links or copies all package skill .md files into that agent skill directory
- Dropped skills contain package-supplied OpenCode-style skill frontmatter and instructions
Evidence against
- No child_process, eval/vm/Function, native binary loading, or credential harvesting found
- No exfiltration endpoint found; runtime network is limited to user-supplied browserManager URL and LLMClient calls
- lib/index.js only exports content operation classes
- mcp-tools.js registers a package-aligned content research tool and requires code only in handler
Behavioral surface
Filesystem
UrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node skills/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node skills/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgskills/postinstall.jsView file
5Install-time AI-agent control hijack evidence:
L5: const projectRoot = process.cwd();
L6: const targetDir = path.join(projectRoot, '.opencode', 'skills');
L7: const sourceDir = path.join(__dirname);
L8:
L9: fs.mkdirSync(targetDir, { recursive: true });
L10:
...
L21: // Fallback: copy if symlink fails
L22: fs.copyFileSync(src, dest);
L23: console.log(` 📄 Copied ${destName}`);
Payload evidence from AGENTS.md:
L23: analytics.md
L24: package.json — deps: @andy-toolforge/core
L25: ```
Critical
Ai Agent Control Hijack
Install-time source drops package-supplied AI-agent/MCP control files or instructions.
skills/postinstall.jsView on unpkg · L5Findings
1 Critical1 High2 Medium4 Low
CriticalAi Agent Control Hijackskills/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @andy-toolforge/content-operations@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @andy-toolforge/content-operations@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.