Loading npm security reports…

@antoneeo/kb-agentic-skill@1.14.0: Suspicious npm security report | LPM Firewall

registry / @antoneeo/kb-agentic-skill / 1.14.0

@antoneeo/kb-agentic-skill@1.14.0

Knowledge-Base & Document-First protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, signal distillation and optional devPNT integration.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall when Claude Code is detected and Python is available.

Impact

It persistently alters a broad foreign AI-agent control surface and causes package code to run in later agent sessions.

Mechanism

Automatic user-level AI-agent hook installation.

AI rationale

The package has a concrete automatic postinstall path that writes a command hook into Claude's user-level settings. This meets the install-control-surface blocking policy even though no exfiltration was found. Product guard normalized uninstall-only AI-agent control-surface mutation to warn-only suspicious because modern npm does not run uninstall lifecycle scripts and the install path is user-invoked.

Evidence

package.jsonscripts/postinstall.jsscripts/lib.js~/.claude/skills/kb-agentic-skill~/.claude/settings.json~/.agentic-sdlc/orient-hook-wired

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/lib.jsView file

15Install-time code directly mutates a foreign AI-agent control surface: L74: cmd: 'claude', L75: home: process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'), L76: envVar: 'CLAUDE_CONFIG_DIR', ... L90: cmd: 'codex', L91: home: process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), L92: envVar: 'CODEX_HOME', ... L132: function copyRecursive(src, dest) { L133: if (typeof fs.cpSync === 'function') { L134: fs.cpSync(src, dest, { recursive: true, force: true }); L135: return; L136: } L137: if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true }); Write operation from scripts/postinstall.js: L15: try { L16: fs.mkdirSync(target, { recursive: true }); L17: copyRecursive(SKILL_SOURCE, target); Foreign user/project scope from scripts/lib.js: L74: cmd: 'claude', L75: home:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/lib.jsView on unpkg · L15

•matchType = normalized_sha256 matchedPackage = @antoneeo/mkt-agentic-sdlc-skill@0.11.0 matchedPath = scripts/lib.js matchedIdentity = npm:[redacted]:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib.jsView on unpkg

skills/kb-agentic-skill/scripts/sdlc_check.pyView file

•path = skills/kb-agentic-skill/scripts/sdlc_check.py kind = build_helper sizeBytes = 94151 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/kb-agentic-skill/scripts/sdlc_check.pyView on unpkg

scripts/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/init.js#virtual:normalized:round1View on unpkg

scripts/init.jsView file

•matchType = normalized_sha256 matchedPackage = @antoneeo/agentic-sdlc-skill@1.33.0 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/init.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a35dbc2f627d919c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @antoneeo/kb-agentic-skill@1.16.0 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.16.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/init.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 4-44json

4 "description": "Knowledge-Base & Document-First protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, signal distillation and optional devPNT integration.",

5 "keywords": [

6 "claude-code",

7 "claude-skill",

8 "gemini-cli",

9 "skill",

10 "knowledge-base",

11 "documentation",

12 "ai-agent"

13 ],

14 "author": "Antonio Pinto (https://github.com/Antoneeo)",

15 "license": "MIT",

16 "publishConfig": {

17 "access": "public"

18 },

19 "bin": {

20 "kb-agentic-init": "scripts/init.js",

21 "kb-agentic-install-skill": "scripts/postinstall.js"

22 },

23 "scripts": {

24 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "preuninstall": "node scripts/preuninstall.js"

26 },

27 "files": [

28 "skills/kb-agentic-skill/SKILL.md",

29 "skills/kb-agentic-skill/templates.md",

30 "skills/kb-agentic-skill/taxonomy.md",

31 "skills/kb-agentic-skill/guides.md",

32 "skills/kb-agentic-skill/vision.md",

33 "skills/kb-agentic-skill/distillation.md",

34 "skills/kb-agentic-skill/reconciliation.md",

35 "skills/kb-agentic-skill/elicitation.md",

36 "skills/kb-agentic-skill/review.md",

37 "skills/kb-agentic-skill/dispatch.md",

38 "skills/kb-agentic-skill/routing.md",

39 "skills/kb-agentic-skill/portability.md",

40 "skills/kb-agentic-skill/ENFORCEMENT.md",

41 "skills/kb-agentic-skill/scripts/sdlc_check.py",

42 "skills/kb-agentic-skill/scripts/sdlc_core.py",

43 "gemini-extension.json",

44 "README.md",

scripts/lib.jsView file

Lines 1-35javascript

1// Shared helpers for the KB Agentic npm scripts (init / postinstall / preuninstall).

2// Single source for client detection and skill-target paths.

3

4const fs = require('fs');

5const path = require('path');

skills/kb-agentic-skill/scripts/sdlc_check.pyView file

•path = skills/kb-agentic-skill/scripts/sdlc_check.py kind = build_helper sizeBytes = 94151 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/kb-agentic-skill/scripts/sdlc_check.pyView on unpkg

scripts/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/init.js#virtual:normalized:round1View on unpkg

scripts/init.jsView file

•matchType = normalized_sha256 matchedPackage = @antoneeo/agentic-sdlc-skill@1.33.0 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/init.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a35dbc2f627d919c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @antoneeo/kb-agentic-skill@1.16.0 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.16.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/init.jsView on unpkg