registry / AI-agent control-surface risk / @arpon007/decision

@arpon007/decision

Claude Code skill (name: decision) that captures *why* decisions were made during sessions — sourced from user prompts, not commit diffs — so any agent can get caught up without re-deriving context. Install with `npm install -g @arpon007/decision` and the

This report shows the evidence for @arpon007/decision@0.1.2, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, then Claude session lifecycle events

Impact

Unconsented broad AI-agent control-surface mutation; user prompts and transcripts are persisted/read within projects.

Mechanism

postinstall global AI-agent configuration and hook deployment

Policy narrative

Installing the npm package automatically runs an installer that writes plugin, skills, commands, and registration JSON into global Claude and .agents control surfaces. The deployed hooks then execute on session lifecycle events: prompt submission appends user prompt content to a project buffer, and session end invokes Claude headlessly with a path to the session transcript. This is an unconsented postinstall mutation of broad/foreign agent surfaces, even though no network exfiltration is present in the inspected source.

AI rationale

Evidence

package.jsonbin/install.jshooks/hooks.jsonhooks/autosave.shhooks/session-end.sh~/.claude/plugins/marketplaces/arpon007/~/.claude/skills/<skill>~/.agents/skills/<skill>~/.claude/commands/<command>.md~/.claude/plugins/known_marketplaces.json~/.claude/plugins/installed_plugins.json<project>/.decision/.buffers/<session-id>.raw

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall automatically launches the installer.
Installer writes skills into global Claude and .agents directories, deleting existing same-named directories first.
Installer deploys hook-bearing plugin files and registers a marketplace/plugin globally.
Installed hooks run on prompt submission and append extracted prompt text to project files.
Session-end hook passes a discovered Claude transcript path to headless claude.

Evidence against

No network client, download, eval, or child-process API is present in the JavaScript installer.
The packaged skill instructs redaction of secrets and PII from decision records.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 9.47 KB of source, external domains: anthropic.com, github.com

Source & flagged code

6 flagged

package.jsonView file

Lines 18-57json

18 "ai"

19 ],

20 "engines": {

21 "node": ">=18"

22 },

23 "main": ".claude-plugin/plugin.json",

24 "bin": {

25 "decision": "bin/decision.js"

26 },

27 "files": [

28 ".claude-plugin/",

29 "hooks/",

30 "skills/",

31 "commands/",

32 "bin/",

33 "SKILL.md",

34 "README.md",

35 "LICENSE"

36 ],

37 "scripts": {

38 "postinstall": "node ./bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "prepublishOnly": "npm run pack:dry",

40 "pack:dry": "npm pack --dry-run",

41 "publish:public": "npm publish --access public",

42 "publish:dry": "npm publish --dry-run --access public"

43 },

44 "repository": {

45 "type": "git",

46 "url": "git+https://github.com/arpondark/decision.git"

47 },

48 "bugs": {

49 "url": "https://github.com/arpondark/decision/issues"

50 },

51 "homepage": "https://github.com/arpondark/decision#readme",

52 "publishConfig": {

53 "access": "public",

54 "registry": "https://registry.npmjs.org/"

55 }

56}

bin/install.jsView file

7* L8: * 1. Copies plugin files into ~/.[redacted]/ L9: * 2. Copies skills into ~/.claude/skills/ and ~/.agents/skills/ for direct skill discovery. L10: * 3. Copies commands into ~/.claude/commands/ for direct slash command availability. L11: * 4. Registers marketplace & updates known_marketplaces.json and installed_plugins.json. ... L26: L27: const CLAUDE_ROOT = path.join(homeDir(), '.claude'); L28: const PLUGINS_ROOT = path.join(CLAUDE_ROOT, 'plugins'); ... L30: const CLAUDE_COMMANDS_ROOT = path.join(CLAUDE_ROOT, 'commands'); L31: const AGENTS_SKILLS_ROOT = path.join(homeDir(), '.agents', 'skills'); L32: ... L34: const MARKETPLACE_DIR = path.join(PLUGINS_ROOT, 'marketplaces', MARKETPLACE_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L7

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

hooks/pre-compact.shView file

•path = hooks/pre-compact.sh kind = build_helper sizeBytes = 2584 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/pre-compact.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackbin/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationbin/install.js

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperhooks/pre-compact.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @arpon007/decision@0.1.2.

The versions list below shows the verdict for each recorded version.

Avoid installing @arpon007/decision@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-17 20:32:17.713Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.1.2latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 17, 2026, 8:21 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code