registry / @dev-mainsequence/command-center-sdk / 0.1.18

@dev-mainsequence/command-center-sdk@0.1.18

The unified framework for building Command Center-compatible resource applications, widgets, workspaces, connections, themes, and embeds.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consuming repository's generic AI-agent skill directory. It copies package-provided skills and may replace its earlier managed directories.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

The package can inject instructions into AI agents operating in the consumer repository without an explicit user command.

Mechanism

Automatic copying of packaged skills into a consumer AI-agent control surface.

Policy narrative

On npm installation, package.json launches cli/postinstall.mjs. That script uses INIT_CWD as the consumer project and calls installAgentSkills. The installer creates and populates <consumer-project>/.agents/skills/command-center from package-owned skill files, replacing previous managed directories. This is an unconsented postinstall write to a generic AI-agent instruction surface.

Rationale

The automatic lifecycle hook modifies a broad consumer AI-agent control surface rather than limiting setup to an explicit command or package-owned location. This meets the install-hook abuse blocking policy.

Evidence

package.jsoncli/postinstall.mjscli/install-agent-skills.mjsagent_scaffold/skills/<consumer-project>/.agents/skills/command-center/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook runs automatically on consumer installation.
Postinstall invokes the skill installer against INIT_CWD, the consumer project directory.
The installer writes packaged content into the generic consumer AI-agent directory .agents/skills/command-center.
It can replace previously managed skill directories during that automatic installation.

Evidence against

No runtime dependency on this package's own name is declared.
The optional MCP network path requires a configured endpoint and access token.
The installer contains path and symlink checks intended to constrain its writes.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 141 file(s), 656 KB of source, external domains: api.example.com, command-center.invalid, mock-json.invalid

Source & flagged code

5 flagged

package.jsonView file

Lines 152-192json

152 "./theme/tailwind.css": "./theme/tailwind.css",

153 "./theme/utilities.css": "./theme/utilities.css",

154 "./widget/built-ins.css": "./widget/built-ins.css",

155 "./tailwind.css": "./theme/tailwind.css",

156 "./styles.css": "./styles.css",

157 "./package.json": "./package.json"

158 },

159 "publishConfig": {

160 "access": "public",

161 "registry": "https://registry.npmjs.org/"

162 },

163 "scripts": {

164 "build": "node ../scripts/clean-sdk-dist.mjs && tsc -p tsconfig.json",

165 "size:check": "node ../scripts/check-package-size.mjs dist/index.js 10000 && node ../scripts/check-package-size.mjs dist/feedback/components.js 25000 && node ../scripts/check-package-size.mjs dist/layout/components.js 20000 && node ../scripts/check-package-size.mjs dist/layout/testing/index.js 30000 && node ../scripts/check-package-size.mjs dist/views/ResourceListPage.js 50000 && node ../scripts/check-package-size.mjs dist/views/ResourceSearch.js 25000 && node ../scripts/check-package-size.mjs dist/views/ResourcePagination.js 25000",

166 "check": "npm run theme:audit && tsc -p tsconfig.json --noEmit && tsc -p tests/types/tsconfig.json",

167 "theme:audit": "node cli/command-center-sdk.mjs theme audit --path styles.css",

168 "test": "vitest run && node --test tests/cli/*.node.mjs",

169 "test:browser": "npm run build && playwright test --config playwright.config.ts",

170 "test:package-smoke": "node tests/cli/packed-consumer-smoke.mjs",

171 "prepack": "npm run build",

172 "postinstall": "node ./cli/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L172

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L172

173 },

174 "peerDependencies": {

175 "react": ">=18 <20",

176 "react-dom": ">=18 <20"

177 },

178 "dependencies": {

179 "lucide-react": "^0.500.0",

180 "react-markdown": "^10.1.0",

181 "rehype-raw": "^7.0.0",

182 "rehype-sanitize": "^6.0.0",

183 "remark-gfm": "^4.0.1"

184 },

185 "devDependencies": {

186 "@playwright/test": "^1.62.1",

187 "@types/react": "^19.0.0",

188 "@types/react-dom": "^19.0.0",

189 "ajv": "^8.20.0",

190 "jsdom": "^29.1.0",

191 "react": "^19.0.0",

192 "react-dom": "^19.0.0",

cli/install-agent-skills.mjsView file

Lines 1-21javascript

1import { cp, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";

2import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/install-agent-skills.mjsView on unpkg · L1

3import { fileURLToPath } from "node:url";

5export const AGENT_SKILL_NAMESPACE = "command-center";

6export const PINNED_FROM_FILENAME = "PINNED_FROM.txt";

7export const PINNED_FROM_SCHEMA = "2";

9const LEGACY_FLAT_SKILL_NAMES = [

10 "adapt-resource-backend",

11 "add-resource-actions",

12 "build-command-center-widget",

13 "build-command-center-workspace",

14 "build-resource-detail",

15 "build-resource-list",

16 "build-resource-picker",

17 "choose-command-center-surface",

18 "embed-command-center-app",

19 "evolve-command-center-contract",

20 "extend-command-center-sdk",

21 "host-command-center-widgets",

contracts/manifest.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

contracts/manifest.jsonView on unpkg

cli/code-repository-sync-local-ops.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dev-mainsequence/command-center-sdk@0.1.13 matchedIdentity = npm:[redacted]:0.1.13 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/code-repository-sync-local-ops.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./cli/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./cli/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/install-agent-skills.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L338: resolvedProjectDir, L339: ".agents", L340: "skills", ... L391: const skillsParent = dirname(destinationRoot); L392: await mkdir(skillsParent, { recursive: true }); L393: const stageRoot = await mkdtemp(join(skillsParent, ".command-center-stage-")); ... L402: const staged = join(stageRoot, ...item.relativePath.split("/")); L403: await mkdir(dirname(staged), { recursive: true }); L404: await cp(item.source, staged, { L405: recursive: true, ... L411: L412: await mkdir(destinationRoot, { recursive: true }); Write operation from cli/install-agent-skills.mjs: L338: resolvedProjectDir, L339: ".agents", L340: "skills", ... L391: const skillsParent = dirname(destinationRoot); L392: await mkdir(skillsParent, { recursive: t

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/install-agent-skills.mjsView on unpkg · L1

contracts/manifest.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

contracts/manifest.jsonView on unpkg

cli/code-repository-sync-local-ops.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/code-repository-sync-local-ops.mjsView on unpkg

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackcli/install-agent-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedcontracts/manifest.json

HighPrevious Version Dangerous Deltacli/code-repository-sync-local-ops.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings