registry / AI-agent control-surface risk / @appfire-ux/audit-agent

@appfire-ux/audit-agent

Claude Code audit agents for Appfire apps — ux-auditor (/ux-audit), ui-auditor (/ui-audit), a11y-auditor (/a11y-audit: WCAG 2.2 + axe-core scan feeding the Appfire VPAT/ACR process), /full-audit parallel orchestration. Confluence-ready MD+HTML+PNG output,

This report shows the evidence for @appfire-ux/audit-agent@0.20260708.2. 4 of 7 known versions are blocked or flagged. The newest version, 0.20260828.0, is flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Source inspection confirms automatic postinstall writes into .claude, which meets the policy threshold for unconsented install-time AI-agent control-surface mutation. The behavior appears package-aligned and non-exfiltrating, but install-time agent command installation is enough to block under the stated boundary. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install lifecycle postinstall or explicit bin invocation

Impact

Unconsented install-time modification of AI-agent commands available in the project or globally.

Mechanism

postinstall copies Claude Code agent/command templates

Policy narrative

Installing the package triggers npm postinstall, which runs bin/install.js. That script resolves the target to the installing project’s .claude directory by default, creates agents/ and commands/ directories, and copies bundled Claude Code agent and slash-command definitions there. This is disclosed and package-aligned, and no exfiltration or remote code payload is evident, but the mutation happens automatically during install against a broad AI-agent control surface.

AI rationale

Evidence

package.jsonbin/install.jstemplates/commands/ux-audit.mdtemplates/commands/ui-audit.mdtemplates/commands/a11y-audit.mdtemplates/commands/full-audit.mdscripts/ux-audit-capture.mjsscripts/a11y-audit-scan.mjsscripts/build-html-reports.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 88.0% confidence with low false-positive risk.

Evidence for policy risk

package.json defines postinstall: node bin/install.js
bin/install.js runs at install time and copies templates into <INIT_CWD|cwd>/.claude
bin/install.js also supports --global writes into ~/.claude
templates/commands/*.md create Claude slash commands /ux-audit, /ui-audit, /a11y-audit, /full-audit

Evidence against

No credential/env harvesting found beyond INIT_CWD target selection
No fixed exfiltration endpoint or remote payload download found
scripts only use Playwright/axe against user-supplied --url and write local audit outputs
README discloses .claude installation behavior

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 19.3 KB of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * Installs the Appfire UX audit agent into a Claude Code config directory.

4 *

5 * Copies templates/agents/* -> <target>/.claude/agents/

6 * templates/commands/* -> <target>/.claude/commands/

7 *

8 * Target resolution:

9 * --global | -g -> ~/.claude (available in every repo)

10 * default -> project root (INIT_CWD when run via npm postinstall,

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/install.jsView on unpkg · L4

11 * otherwise current working directory)

12 *

13 * Existing files are overwritten — re-running the script IS the update mechanism

14 * (npm update @appfire-ux/audit-agent && npx @appfire-ux/audit-agent).

15 */

17'use strict';

19const fs = require('fs');

20const path = require('path');

21const os = require('os');

23const args = process.argv.slice(2);

24const isGlobal = args.includes('--global') || args.includes('-g');

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install.jsView file

4Install-time AI-agent control hijack evidence: L4: * L5: * Copies templates/agents/* -> <target>/.claude/agents/ L6: * templates/commands/* -> <target>/.claude/commands/ L7: * L8: * Target resolution: L9: * --global | -g -> ~/.claude (available in every repo) L10: * default -> project root (INIT_CWD when run via npm postinstall, ... L29: const targetRoot = isGlobal L30: ? path.join(os.homedir(), '.claude') L31: : path.join(process.env.INIT_CWD || process.cwd(), '.claude'); L32: ... L42: if (!fs.existsSync(src)) return []; Payload evidence from templates/agents/ux-auditor.md: L45: - **HTML** — open in browser → ⌘A / Ctrl+A → copy → paste into Confluence L46: - **PNG** in `assets/` — separate files only; **never** base64 in MD/HTML L47: ... L70:

Findings

1 Critical1 High3 Medium3 Low

CriticalAi Agent Control Hijackbin/install.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @appfire-ux/audit-agent@0.20260708.2.

The versions list below shows the verdict for each recorded version.

Avoid installing @appfire-ux/audit-agent@0.20260708.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-08 10:42:58.960Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

0.20260828.0latestSuspicious—WarnUnder ReviewAug 28, 2026, 2:27 PM 0.20260708.2shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 8, 2026, 10:41 AM 0.20260708.1SuspiciousAgent extension lifecycle riskWarnPublishedJul 8, 2026, 9:56 AM 0.20260708.0SuspiciousAgent extension lifecycle riskWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code