Loading npm security reports…

@antoneeo/kb-agentic-skill@1.4.7: AI-agent control-surface risk | LPM Firewall

registry / @antoneeo/kb-agentic-skill / 1.4.7

@antoneeo/kb-agentic-skill@1.4.7

Knowledge-Base & Document-First protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, signal distillation and optional devPNT integration.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically installs a bundled agent skill into detected Claude, Gemini, Codex, and Antigravity control surfaces. Detection includes the mere presence of their home directories, so no explicit setup command is required.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of the package

Impact

Unconsented modification of broad, foreign AI-agent instruction/control surfaces.

Mechanism

postinstall recursive forced copy into AI-agent skill directories

Policy narrative

On installation, postinstall detects multiple AI clients by command, environment variable, or existing config directory. For every detected client it recursively copies the package skill into that client's globally loaded skill directory with force enabled. This mutates foreign AI-agent control surfaces without an explicit user command; preuninstall later recursively removes those directories.

Rationale

This is concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, meeting the blocking policy. Absence of exfiltration does not mitigate that install-time control-surface write.

Evidence

package.jsonscripts/postinstall.jsscripts/lib.jsscripts/preuninstall.jsskills/kb-agentic-skill/**~/.claude/skills/kb-agentic~/.gemini/skills/kb-agentic~/.codex/skills/kb-agentic

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/lib.jsView file

12Install-time code directly mutates a foreign AI-agent control surface: L74: cmd: 'claude', L75: home: process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'), L76: envVar: 'CLAUDE_CONFIG_DIR', ... L90: cmd: 'codex', L91: home: process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), L92: envVar: 'CODEX_HOME', ... L132: function copyRecursive(src, dest) { L133: if (typeof fs.cpSync === 'function') { L134: fs.cpSync(src, dest, { recursive: true, force: true }); L135: return; L136: } L137: if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true }); Write operation from scripts/postinstall.js: L12: try { L13: fs.mkdirSync(target, { recursive: true }); L14: copyRecursive(SKILL_SOURCE, target); Foreign user/project scope from scripts/lib.js: L74: cmd: 'claude', L75: home:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/lib.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @antoneeo/kb-agentic-skill@1.4.4 matchedPath = scripts/lib.js matchedIdentity = npm:[redacted]:1.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/lib.jsView on unpkg

skills/kb-agentic-skill/scripts/sdlc_check.pyView file

•path = skills/kb-agentic-skill/scripts/sdlc_check.py kind = build_helper sizeBytes = 63957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/kb-agentic-skill/scripts/sdlc_check.pyView on unpkg

scripts/init.jsView file

•matchType = normalized_sha256 matchedPackage = @antoneeo/agentic-sdlc-skill@1.23.0 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/init.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7d96d3382711bb26 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @antoneeo/kb-agentic-skill@1.4.4 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.4.4 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/init.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 4-44json

4 "description": "Knowledge-Base & Document-First protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, signal distillation and optional devPNT integration.",

5 "keywords": [

6 "claude-code",

7 "claude-skill",

8 "gemini-cli",

9 "skill",

10 "knowledge-base",

11 "documentation",

12 "ai-agent"

13 ],

14 "author": "Antonio Pinto (https://github.com/Antoneeo)",

15 "license": "MIT",

16 "publishConfig": {

17 "access": "public"

18 },

19 "bin": {

20 "kb-agentic-init": "scripts/init.js",

21 "kb-agentic-install-skill": "scripts/postinstall.js"

22 },

23 "scripts": {

24 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "preuninstall": "node scripts/preuninstall.js"

26 },

27 "files": [

28 "skills/kb-agentic-skill/SKILL.md",

29 "skills/kb-agentic-skill/templates.md",

30 "skills/kb-agentic-skill/taxonomy.md",

31 "skills/kb-agentic-skill/guides.md",

32 "skills/kb-agentic-skill/vision.md",

33 "skills/kb-agentic-skill/distillation.md",

34 "skills/kb-agentic-skill/reconciliation.md",

35 "skills/kb-agentic-skill/elicitation.md",

36 "skills/kb-agentic-skill/review.md",

37 "skills/kb-agentic-skill/dispatch.md",

38 "skills/kb-agentic-skill/routing.md",

39 "skills/kb-agentic-skill/portability.md",

40 "skills/kb-agentic-skill/ENFORCEMENT.md",

41 "skills/kb-agentic-skill/scripts/sdlc_check.py",

42 "skills/kb-agentic-skill/scripts/sdlc_core.py",

43 "gemini-extension.json",

44 "README.md",

scripts/lib.jsView file

Lines 1-32javascript

1// Shared helpers for the KB Agentic npm scripts (init / postinstall / preuninstall).

2// Single source for client detection and skill-target paths.

3

4const fs = require('fs');

5const path = require('path');

skills/kb-agentic-skill/scripts/sdlc_check.pyView file

•path = skills/kb-agentic-skill/scripts/sdlc_check.py kind = build_helper sizeBytes = 63957 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/kb-agentic-skill/scripts/sdlc_check.pyView on unpkg

scripts/init.jsView file

•matchType = normalized_sha256 matchedPackage = @antoneeo/agentic-sdlc-skill@1.23.0 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/init.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7d96d3382711bb26 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @antoneeo/kb-agentic-skill@1.4.4 matchedPath = scripts/init.js matchedIdentity = npm:[redacted]:1.4.4 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/init.jsView on unpkg