Loading npm security reports…

@archangel70/cosmo@1.10.0: AI-agent control-surface risk | LPM Firewall

registry / @archangel70/cosmo / 1.10.0

@archangel70/cosmo@1.10.0

Local-first, multi-agent Astro website builder for Claude, Codex, Antigravity, and the command line.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically changes three AI-agent control surfaces in the user's home directory. It deploys package-controlled skills, a workflow, and a launcher before the user invokes the CLI.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global install of the package, or an install with COSMO_POSTINSTALL_FORCE=1.

Impact

The installed agent platforms can load package-authored instructions and launcher code in later sessions.

Mechanism

Postinstall copies package-supplied agent extensions into global Claude, Codex, and Antigravity paths.

Policy narrative

Installing the package globally activates postinstall. The hook iterates over Claude, Codex, and Antigravity and overwrites package-owned targets in their global configuration areas. This silently establishes persistent, package-authored agent behavior beyond the npm package directory; later use of those agent platforms may load the copied skills or workflow. No remote payload or credential theft was found, but the automatic broad control-surface mutation is concrete.

AI rationale

The package has an automatic postinstall path that writes package-controlled content into multiple foreign global AI-agent configuration surfaces. This meets the install-hook abuse policy even though no exfiltration or remote payload was found.

Evidence

package.jsonscripts/postinstall.mjspackages/cli/lib/agent-adapters.mjspackages/cli/lib/claude-plugin.mjs~/.claude/skills/cosmo~/.agents/skills/cosmo~/.gemini/config/global_workflows/cosmo.md

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/cli/lib/agent-adapters.mjsView file

17export function codexSkillTarget() { L18: return path.join(homeRoot('COSMO_CODEX_DIR', path.join(os.homedir(), '.agents')), 'skills', 'cosmo'); L19: } ... L46: } L47: fs.mkdirSync(path.dirname(target), { recursive: true }); L48: fs.cpSync(sharedSkillSource, target, { recursive: true }); L49: return skillStatus(target); ... L72: if (fs.existsSync(target) && replace && !antigravityStatus().installed) throw new Error(`Refusing to replace a workflow Cosmo does not own: ${target}`); L73: fs.mkdirSync(path.dirname(target), { recursive: true }); L74: fs.copyFileSync(source, target); L75: return antigravityStatus(); ... L95: const provider = normalizeAgent(agent);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

packages/cli/lib/agent-adapters.mjsView on unpkg · L17

packages/cli/lib/claude-plugin.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { fileurltopath } from 'node:url'; import { spawnsync } from 'node:child_process'; const moduledirectory = path.dirname(fileurltopath(import.meta.url)); const defaultsource = path.resolve(moduledirectory, '../../../plugins/claude-code/cosmo'); const sharedskill = path.resolve(moduledirectory, '../../../plugins/agent-skills/cosmo/skill.md'); const runtimecli = path.resolve(moduledirectory, '../bin/cosmo.mjs'); function shellquote(value) { return `'${string(value).replaceall("'", `'"'"'`)}'`; } export function claudeplugintarget() { const claudedirectory = process.env.cosmo_claude_dir

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

packages/cli/lib/claude-plugin.mjsView on unpkg

Source & flagged code

4 flagged

package.jsonView file

Lines 63-103json

63 "url": "git+https://github.com/ArchAngel70/cosmo.git"

64 },

65 "bugs": {

66 "url": "https://github.com/ArchAngel70/cosmo/issues"

67 },

68 "homepage": "https://github.com/ArchAngel70/cosmo#readme",

69 "workspaces": [

70 "packages/*",

71 "templates/*"

72 ],

73 "scripts": {

74 "build": "npm run build --workspace @cosmo/astro-starter",

75 "check": "npm run astro:check --workspace @cosmo/astro-starter",

76 "qa": "node packages/cli/bin/cosmo.mjs check templates/astro-site",

77 "integrity:qa": "node packages/cli/bin/cosmo.mjs integrity check templates/astro-site",

78 "content:qa": "node packages/cli/bin/cosmo.mjs content check templates/astro-site",

79 "copy:qa": "node packages/cli/bin/cosmo.mjs copy check templates/astro-site",

80 "intelligence:qa": "node packages/cli/bin/cosmo.mjs intelligence check templates/astro-site",

81 "browser:qa": "node packages/cli/bin/cosmo.mjs browser check templates/astro-site",

82 "package:smoke": "node scripts/smoke-package.mjs",

83 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L83

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L83

84 "test": "node --test packages/cli/test/*.test.mjs",

85 "verify": "npm run test && npm run check && npm run integrity:qa && npm run qa && npm run copy:qa && npm run content:qa && npm run intelligence:qa && npm run browser:qa"

86 },

87 "dependencies": {

88 "axe-core": "^4.13.0",

89 "basic-ftp": "^6.2.1",

90 "chrome-launcher": "^1.2.1",

91 "gray-matter": "^4.0.3",

92 "lighthouse": "^13.4.1",

93 "playwright-core": "^1.62.1",

94 "ssh2-sftp-client": "^12.1.1"

95 },

96 "engines": {

97 "node": ">=22.12.0"

98 },

99 "publishConfig": {

100 "access": "public",

101 "registry": "https://registry.npmjs.org"

102 }

103}

packages/cli/lib/agent-adapters.mjsView file

Lines 1-37javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { fileURLToPath } from 'node:url';

packages/cli/lib/claude-plugin.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { fileurltopath } from 'node:url'; import { spawnsync } from 'node:child_process'; const moduledirectory = path.dirname(fileurltopath(import.meta.url)); const defaultsource = path.resolve(moduledirectory, '../../../plugins/claude-code/cosmo'); const sharedskill = path.resolve(moduledirectory, '../../../plugins/agent-skills/cosmo/skill.md'); const runtimecli = path.resolve(moduledirectory, '../bin/cosmo.mjs'); function shellquote(value) { return `'${string(value).replaceall("'", `'"'"'`)}'`; } export function claudeplugintarget() { const claudedirectory = process.env.cosmo_claude_dir

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

packages/cli/lib/claude-plugin.mjsView on unpkg