registry / @dev-mainsequence/command-center-sdk / 0.4.3
@dev-mainsequence/command-center-sdk@0.4.3
The framework-neutral SDK for building Command Center-compatible resource applications, navigation, layouts, themes, feedback, and embeds.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiPostinstall performs first-party agent skill setup in package-owned .agents namespaces and, by default, can forward an existing access token to any operator-configured MCP URL. That is install-time agent-surface mutation and conditional credential exposure, not a proven hidden exfiltration or foreign control-surface hijack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Automatic npm postinstall in a non-global consumer project, with MCP writes only when URL and token environment variables are present and COMMAND_CENTER_SDK_MCP_POSTINSTALL is not 0.
Impact
Agent skill files in the consumer project change without a separate user command. A configured access token is sent to an endpoint that is not limited to one host. No hidden recipient, secret scraping, or code execution chain was found.
Mechanism
installAgentSkills copies packaged skill trees into the command-center namespace and prunes other entries there. The MCP path posts the bearer token to the operator-configured HTTP(S) endpoint and writes the returned skill files into the mainsequence namespace.
AI rationale
Postinstall performs first-party agent skill setup in package-owned .agents namespaces and, by default, can forward an existing access token to any operator-configured MCP URL. That is install-time agent-surface mutation and conditional credential exposure, not a proven hidden exfiltration or foreign control-surface hijack.
Evidence
package.jsoncli/postinstall.mjscli/install-agent-skills.mjscli/install-mcp-skills.mjscli/mcp-platform-skills.mjs.agents/skills/command-center.agents/skills/mainsequence
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall runs node ./cli/postinstall.mjs on install.
- postinstall calls installAgentSkills with command npm postinstall for the consumer INIT_CWD.
- That installer writes packaged skills under .agents/skills/command-center and removes unauthorized entries in that namespace.
- Unless COMMAND_CENTER_SDK_MCP_POSTINSTALL is 0, postinstall also installs remote MCP skills under .agents/skills/mainsequence when URL and token env vars exist.
- The MCP URL is any http or https value from the environment, and MAINSEQUENCE_ACCESS_TOKEN is sent as a bearer token to that URL.
Evidence against
- Global installs and the SDK source repository are skipped.
- Writes stay inside the command-center and mainsequence skill namespaces.
- MCP sync is skipped when URL or token is missing and failures do not stop the npm install.
- Dependencies do not include this package name, so there is no nested lifecycle self-install chain.
- Git and npm spawn helpers are on explicit CLI maintenance paths, not the postinstall path.
Behavioral surface
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./cli/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./cli/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/install-agent-skills.mjsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L377: resolvedProjectDir,
L378: ".agents",
L379: "skills",
...
L428: const skillsParent = dirname(destinationRoot);
L429: await mkdir(skillsParent, { recursive: true });
L430: const stageRoot = await mkdtemp(join(skillsParent, ".command-center-stage-"));
...
L439: const staged = join(stageRoot, ...item.relativePath.split("/"));
L440: await mkdir(dirname(staged), { recursive: true });
L441: await cp(item.source, staged, {
L442: recursive: true,
...
L448:
L449: await mkdir(destinationRoot, { recursive: true });
Write operation from cli/install-agent-skills.mjs:
L377: resolvedProjectDir,
L378: ".agents",
L379: "skills",
...
L428: const skillsParent = dirname(destinationRoot);
L429: await mkdir(skillsParent, { recursive: t
Findings
1 Critical6 High3 Medium4 Low
CriticalAi Agent Control Hijackcli/install-agent-skills.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedstyles.css
HighKnown Malware Source Similaritycli/application-sdk-maintenance.mjs
HighKnown Malware Source Similaritycli/code-repository-sync-local-ops.mjs
HighKnown Malware Source Similaritydist/embed/static-site.js
HighKnown Malware Source Fingerprint Signaturecli/application-sdk-maintenance.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @dev-mainsequence/command-center-sdk@0.4.3.
See all versions of @dev-mainsequence/command-center-sdk for other recorded verdicts.
- Review the evidence and your use of @dev-mainsequence/command-center-sdk@0.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.