registry / AI-agent control-surface risk / @andy-toolforge/messaging
@andy-toolforge/messaging
Messenger facade + Telegram/Discord/Console adapters for automation notifications
This report shows the evidence for @andy-toolforge/messaging@0.1.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe runtime messaging adapters are user-invoked and package-aligned, but the install-time mutation of a foreign project-level agent skill directory is concrete and unconsented.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation
Impact
Unconsented modification of a project-level AI-agent control surface.
Mechanism
postinstall symlink injection into .opencode/skills
Policy narrative
During installation, postinstall resolves the parent project’s .opencode/skills directory, creates it, deletes an existing same-named skill, and symlinks package-provided Markdown into it. This changes an AI-agent instruction surface without an explicit user setup command.
AI rationale
The runtime messaging adapters are user-invoked and package-aligned, but the install-time mutation of a foreign project-level agent skill directory is concrete and unconsented.
Evidence
package.jsonpostinstall.jsskills/messaging-dispatch.md.opencode/skills/messaging-messaging-dispatch.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- Install hook creates the project-level .opencode/skills directory.
- It replaces and symlinks package-provided skill files into that foreign agent control surface without consent.
Evidence against
- The installed Markdown skill only documents notification usage; no hidden commands or credential collection found.
- Telegram and Discord requests occur only when callers construct adapters and invoke send().
Behavioral surface
FilesystemNetwork
UrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
2Install-time AI-agent control hijack evidence:
L2:
L3: // Symlink skill files into the repo-level .opencode/skills/ dir with the
L4: // messaging- prefix so client projects receive them (AGENTS.md section 3.4).
L5: const fs = require('fs');
...
L8: const SKILLS_DIR = path.resolve(__dirname, 'skills');
L9: const TARGET_DIR = path.resolve(__dirname, '..', '..', '.opencode', 'skills');
L10:
L11: try {
L12: fs.mkdirSync(TARGET_DIR, { recursive: true });
L13: for (const file of fs.readdirSync(SKILLS_DIR)) {
Payload evidence from skills/messaging-dispatch.md:
L13: 2. Read tokens from env (`TELEGRAM_BOT_TOKEN` / `DISCORD_BOT_TOKEN`) — never hardcode.
L14: 3. Send via `messenger.send('<adapter>', { text })` for one channel, or `sendAll({ text })` to fan out.
L15:
...
L22: telegram: new Telegram
Findings
1 Critical3 High3 Medium4 Low
CriticalAi Agent Control Hijackpostinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepostinstall.js
HighAi Review Evidencepostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @andy-toolforge/messaging@0.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @andy-toolforge/messaging@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.