registry / @antoneeo/kb-agentic-skill / 1.10.0

@antoneeo/kb-agentic-skill@1.10.0

Knowledge-Base & Document-First protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, signal distillation and optional devPNT integration.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall copies this skill into Claude Code, Gemini CLI, Codex, and Antigravity skill directories whenever those clients are detected. For Claude Code it also writes a SessionStart command hook into user-level settings.json so every project on the machine runs the packaged Python checker at session start, with no prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or npm update of this package, which runs the postinstall script.

Impact

Third-party agent skill instructions and a per-session shell command are installed into the user's AI clients without a separate consent step, changing how those agents start and what they load.

Mechanism

unconsented postinstall write of foreign agent skills and a machine-wide Claude SessionStart hook

Policy narrative

When npm installs this package, postinstall.js runs with no prompt. If Claude Code, Gemini CLI, Codex, or Antigravity is detected by CLI, env var, or a home such as ~/.claude, it copies the skill tree into that agent's skills directory. For Claude Code it then writes a SessionStart command hook into user-level settings.json so every project on the machine runs the packaged validator when a session starts. The installer treats the npm install itself as consent and never asks. That is unconsented mutation of foreign, machine-wide AI-agent control surfaces.

AI rationale

postinstall copies this skill into Claude, Gemini, Codex, and Antigravity skill directories and, for Claude Code, injects a machine-wide SessionStart hook into user-level settings.json without a prompt. That is unconsented install-time mutation of foreign AI-agent control surfaces, so the package is blocked.

Evidence

package.jsonscripts/postinstall.js

@antoneeo/kb-agentic-skill@1.10.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code