registry / AI-agent control-surface risk / @choprapadam/agent-cli
@choprapadam/agent-cli
Agent CLI — upload media and connect to the Agent CLI backend
This report shows the evidence for @choprapadam/agent-cli@0.1.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.2.1, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs an unconsented global-install postinstall mutation of Claude’s skill directory and replaces conflicting symlinks. Its explicit CLI network and upload behavior does not remove that lifecycle attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running a global npm installation without the documented opt-out variables.
Impact
It alters the local AI-agent control surface and can overwrite an existing symlink target.
Mechanism
Postinstall copies a skill and replaces a foreign agent skill symlink.
Policy narrative
On global installation, the package runs a postinstall hook that copies its skill into ~/.agents/skills/agent-cli and creates ~/.claude/skills/agent-cli. If the Claude path is an existing symlink to a different destination, the hook deletes it before creating its own link. This is an unconsented install-time mutation of a foreign AI-agent control surface.
AI rationale
The package performs an unconsented global-install postinstall mutation of Claude’s skill directory and replaces conflicting symlinks. Its explicit CLI network and upload behavior does not remove that lifecycle attack surface.
Evidence
package.jsonscripts/postinstall.mjsscripts/skill-install.mjsskills/agent-cli/SKILL.mddist/index.js~/.agents/skills/agent-cli~/.claude/skills/agent-cli
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- The postinstall hook runs skill installation during global npm installation unless an opt-out environment variable is set.
- The installer copies package content into the agent skill directory and creates a Claude skill symlink.
- An existing Claude skill symlink with a different target is removed and replaced without consent.
Evidence against
- The packaged skill documents the CLI’s media upload and login commands; no hidden payload is present.
- Network requests are limited to the configured service for explicit login and upload commands.
- The lifecycle hook exits for non-global installations and CI.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
9import { join } from "path";
L10: var CONFIG_DIR = join(homedir(), ".agent-cli");
L11: var CONFIG_PATH = join(CONFIG_DIR, "config.json");
L12: function loadConfig() {
L13: const apiUrl = process.env.AGENT_CLI_API_URL ?? "https://agent-cli.padamchopra.me";
L14: if (!existsSync(CONFIG_PATH)) {
...
L18: const raw = readFileSync(CONFIG_PATH, "utf8");
L19: const parsed = JSON.parse(raw);
L20: return {
...
L37: function getMachineName() {
L38: return hostname().split(".")[0] || "unknown";
L39: }
High
Findings
1 Critical3 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/skill-install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/index.js
HighSuspicious Lifecycle Evidencescripts/postinstall.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @choprapadam/agent-cli@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @choprapadam/agent-cli@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.