registry / @dev-mainsequence/command-center-sdk / 0.5.1
@dev-mainsequence/command-center-sdk@0.5.1
The framework-neutral SDK for building Command Center-compatible resource applications, navigation, layouts, themes, feedback, and embeds.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAutomatic install writes first-party skills into the project agent skill directory and can pull remote skill text when MCP settings already exist. The destinations stay inside this package's namespaces and the token goes to the operator-configured MCP endpoint, so this is guarded extension setup rather than a foreign control-surface hijack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall runs node ./cli/postinstall.mjs and uses INIT_CWD as the target project.
Impact
Agents that load project .agents/skills will see publisher-supplied and remotely fetched skill instructions. The access token is sent only to the operator-selected HTTP(S) MCP URL.
Mechanism
The script copies packaged skill trees into the command-center namespace. Unless COMMAND_CENTER_SDK_MCP_POSTINSTALL is 0, it POSTs the configured access token to the configured MCP URL and writes the returned skill files into the mainsequence namespace.
AI rationale
Automatic install writes first-party skills into the project agent skill directory and can pull remote skill text when MCP settings already exist. The destinations stay inside this package's namespaces and the token goes to the operator-configured MCP endpoint, so this is guarded extension setup rather than a foreign control-surface hijack.
Evidence
package.jsoncli/postinstall.mjscli/install-agent-skills.mjscli/install-mcp-skills.mjscli/mcp-platform-skills.mjs.agents/skills/command-center.agents/skills/mainsequence
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm postinstall runs node ./cli/postinstall.mjs.
- Postinstall copies packaged skills into the consumer project under .agents/skills/command-center using INIT_CWD.
- Unless COMMAND_CENTER_SDK_MCP_POSTINSTALL is 0, postinstall fetches platform skills with MAINSEQUENCE_ACCESS_TOKEN and writes them under .agents/skills/mainsequence.
- The MCP URL is any absolute http or https URL from environment variables, and the bearer token is sent there with no host allowlist.
Evidence against
- Global installs and the SDK source repository are skipped.
- Writes stay inside the command-center and mainsequence skill namespaces, with symlink and path checks.
- MCP sync is skipped when the URL or token is missing, and a fetch failure does not fail the install.
- Dependencies are lucide-react plus React peers. No eval, self-dependency, or fixed package-controlled exfiltration host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./cli/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./cli/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/install-agent-skills.mjsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L377: resolvedProjectDir,
L378: ".agents",
L379: "skills",
...
L428: const skillsParent = dirname(destinationRoot);
L429: await mkdir(skillsParent, { recursive: true });
L430: const stageRoot = await mkdtemp(join(skillsParent, ".command-center-stage-"));
...
L439: const staged = join(stageRoot, ...item.relativePath.split("/"));
L440: await mkdir(dirname(staged), { recursive: true });
L441: await cp(item.source, staged, {
L442: recursive: true,
...
L448:
L449: await mkdir(destinationRoot, { recursive: true });
Write operation from cli/install-agent-skills.mjs:
L377: resolvedProjectDir,
L378: ".agents",
L379: "skills",
...
L428: const skillsParent = dirname(destinationRoot);
L429: await mkdir(skillsParent, { recursive: t
Findings
1 Critical5 High3 Medium4 Low
CriticalAi Agent Control Hijackcli/install-agent-skills.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedstyles.css
HighKnown Malware Source Similaritycli/application-sdk-maintenance.mjs
HighKnown Malware Source Similaritycli/code-repository-sync-local-ops.mjs
HighKnown Malware Source Similaritydist/embed/static-site.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @dev-mainsequence/command-center-sdk@0.5.1.
See all versions of @dev-mainsequence/command-center-sdk for other recorded verdicts.
- Review the evidence and your use of @dev-mainsequence/command-center-sdk@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.