Loading npm security reports…

@arpon007/decision@0.1.2: AI-agent control-surface risk | LPM Firewall

registry / @arpon007/decision / 0.1.2

@arpon007/decision@0.1.2

Claude Code skill (name: decision) that captures *why* decisions were made during sessions — sourced from user prompts, not commit diffs — so any agent can get caught up without re-deriving context. Install with `npm install -g @arpon007/decision` and the

AI Security Review

scanned 1h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs and registers persistent Claude/.agents extensions. Those extensions add lifecycle hooks that capture prompts and direct a headless agent to read session transcripts.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, then Claude session lifecycle events

Impact

Unconsented broad AI-agent control-surface mutation; user prompts and transcripts are persisted/read within projects.

Mechanism

postinstall global AI-agent configuration and hook deployment

Policy narrative

Installing the npm package automatically runs an installer that writes plugin, skills, commands, and registration JSON into global Claude and .agents control surfaces. The deployed hooks then execute on session lifecycle events: prompt submission appends user prompt content to a project buffer, and session end invokes Claude headlessly with a path to the session transcript. This is an unconsented postinstall mutation of broad/foreign agent surfaces, even though no network exfiltration is present in the inspected source.

Rationale

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking policy for unconsented postinstall mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsonbin/install.jshooks/hooks.jsonhooks/autosave.shhooks/session-end.sh~/.claude/plugins/marketplaces/arpon007/~/.claude/skills/<skill>~/.agents/skills/<skill>

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install.jsView file

7* L8: * 1. Copies plugin files into ~/.[redacted]/ L9: * 2. Copies skills into ~/.claude/skills/ and ~/.agents/skills/ for direct skill discovery. L10: * 3. Copies commands into ~/.claude/commands/ for direct slash command availability. L11: * 4. Registers marketplace & updates known_marketplaces.json and installed_plugins.json. ... L26: L27: const CLAUDE_ROOT = path.join(homeDir(), '.claude'); L28: const PLUGINS_ROOT = path.join(CLAUDE_ROOT, 'plugins'); ... L30: const CLAUDE_COMMANDS_ROOT = path.join(CLAUDE_ROOT, 'commands'); L31: const AGENTS_SKILLS_ROOT = path.join(homeDir(), '.agents', 'skills'); L32: ... L34: const MARKETPLACE_DIR = path.join(PLUGINS_ROOT, 'marketplaces', MARKETPLACE_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L7

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

hooks/pre-compact.shView file

•path = hooks/pre-compact.sh kind = build_helper sizeBytes = 2584 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/pre-compact.shView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 18-57json

18 "ai"

19 ],

20 "engines": {

21 "node": ">=18"

22 },

23 "main": ".claude-plugin/plugin.json",

24 "bin": {

25 "decision": "bin/decision.js"

26 },

27 "files": [

28 ".claude-plugin/",

29 "hooks/",

30 "skills/",

31 "commands/",

32 "bin/",

33 "SKILL.md",

34 "README.md",

35 "LICENSE"

36 ],

37 "scripts": {

38 "postinstall": "node ./bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "prepublishOnly": "npm run pack:dry",

40 "pack:dry": "npm pack --dry-run",

41 "publish:public": "npm publish --access public",

42 "publish:dry": "npm publish --dry-run --access public"

43 },

44 "repository": {

45 "type": "git",

46 "url": "git+https://github.com/arpondark/decision.git"

47 },

48 "bugs": {

49 "url": "https://github.com/arpondark/decision/issues"

50 },

51 "homepage": "https://github.com/arpondark/decision#readme",

52 "publishConfig": {

53 "access": "public",

54 "registry": "https://registry.npmjs.org/"

55 }

56}

57

bin/install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * install.js — runs automatically after `npm install -g @arpon007/decision`.

4 *

5 * Sets up the plugin so /decision, /decision-review, /decision-logger, /decision-briefing show up

6 * as slash commands and skills in Claude Code and agent environments (skills.sh compatible):

7 *

8 * 1. Copies plugin files into ~/.claude/plugins/marketplaces/arpon007/plugins/decision/

9 * 2. Copies skills into ~/.claude/skills/ and ~/.agents/skills/ for direct skill discovery.

10 * 3. Copies commands into ~/.claude/commands/ for direct slash command availability.

hooks/pre-compact.shView file

•path = hooks/pre-compact.sh kind = build_helper sizeBytes = 2584 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/pre-compact.shView on unpkg