registry / @choprapadam/agent-cli / 0.2.1
@choprapadam/agent-cli@0.2.1
Agent CLI — upload media and connect to the Agent CLI backend
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook performs automatic first-party agent skill setup during global installation and can replace existing same-name files or links. The inspected behavior supports a warning for extension lifecycle risk, not a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A global npm install outside CI, unless either skip variable is set.
Impact
The skill becomes available to agents, and an existing same-name skill directory may be deleted. The source establishes first-party setup but leaves a lifecycle extension risk.
Mechanism
The postinstall hook copies the bundled skill into ~/.agents/skills/agent-cli and creates or repairs ~/.claude/skills/agent-cli.
AI rationale
The install hook performs automatic first-party agent skill setup during global installation and can replace existing same-name files or links. The inspected behavior supports a warning for extension lifecycle risk, not a confirmed attack.
Evidence
package.jsonscripts/postinstall.mjsscripts/skill-install.mjsskills/agent-cli/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script, which proceeds for global installs unless a skip variable or CI setting is present.
- That hook installs the bundled agent-cli skill into the user's home directories and creates a Claude skill symlink.
- Installation removes any existing ~/.agents/skills/agent-cli directory before copying the bundled skill, and removes a differing symlink at ~/.claude/skills/agent-cli.
- The bundled skill describes Agent CLI upload and login workflows, so this is first-party extension setup; the automatic global-install mutation still creates a lifecycle risk.
Evidence against
- The inspected installer copies the package's named skill and adjusts its corresponding symlink; it contains no network transfer or credential access.
- The CLI also exposes an explicit `agent-cli skill install` command for installing the same skill.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
10import { join } from "path";
L11: var CONFIG_DIR = join(homedir(), ".agent-cli");
L12: var CONFIG_PATH = join(CONFIG_DIR, "config.json");
L13: function loadConfig() {
L14: const apiUrl = process.env.AGENT_CLI_API_URL ?? "https://agent-cli.padamchopra.me";
L15: if (!existsSync(CONFIG_PATH)) {
...
L19: const raw = readFileSync(CONFIG_PATH, "utf8");
L20: const parsed = JSON.parse(raw);
L21: return {
...
L38: function getMachineName() {
L39: return hostname().split(".")[0] || "unknown";
L40: }
High
Findings
1 Critical3 High4 Medium6 Low
CriticalAi Agent Control Hijackscripts/skill-install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/index.js
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @choprapadam/agent-cli@0.2.1.
See all versions of @choprapadam/agent-cli for other recorded verdicts.
- Review the evidence and your use of @choprapadam/agent-cli@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.