registry / @dev-mainsequence/command-center-sdk / 0.5.2
@dev-mainsequence/command-center-sdk@0.5.2
The framework-neutral SDK for building Command Center-compatible resource applications, navigation, layouts, themes, feedback, and embeds.
AI Security Review
scanned 29d ago · by lpm-firewall-aiPostinstall always installs this package's own skills under .agents/skills/command-center and, unless opted out, forwards MAINSEQUENCE_ACCESS_TOKEN to an operator-chosen HTTP(S) MCP URL before writing returned skills under .agents/skills/mainsequence. That is first-party agent-extension setup with conditional credential exposure, not a hardcoded foreign control-surface hijack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall on a non-global install, using INIT_CWD as the target repository.
Impact
Vendor agent skill directories in the consumer project are replaced during install. The access token can be sent to whatever HTTP(S) endpoint the operator configured, which is conditional exposure rather than a hardcoded recipient.
Mechanism
installAgentSkills copies packaged skill trees and prunes other files in the command-center namespace. fetchPlatformSkillCatalog then POSTs MAINSEQUENCE_ACCESS_TOKEN as a bearer credential to the operator HTTP(S) URL, and installMcpAgentSkills writes the catalog.
AI rationale
Postinstall always installs this package's own skills under .agents/skills/command-center and, unless opted out, forwards MAINSEQUENCE_ACCESS_TOKEN to an operator-chosen HTTP(S) MCP URL before writing returned skills under .agents/skills/mainsequence. That is first-party agent-extension setup with conditional credential exposure, not a hardcoded foreign control-surface hijack.
Evidence
package.jsoncli/postinstall.mjscli/install-agent-skills.mjscli/mcp-platform-skills.mjscli/install-mcp-skills.mjs.agents/skills/command-center.agents/skills/mainsequence
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall runs node ./cli/postinstall.mjs on install.
- Local postinstall calls installAgentSkills with command npm postinstall and copies skills into the consumer project.
- The skill destination is .agents/skills/command-center, and entries in that namespace that are not in the packaged set are removed.
- Unless COMMAND_CENTER_SDK_MCP_POSTINSTALL is 0, a present MAINSEQUENCE_ACCESS_TOKEN is sent as a bearer token to any operator HTTP(S) MCP URL, and returned skills are written under .agents/skills/mainsequence.
Evidence against
- There is no preinstall hook, no runtime dependency on this package name, and dist/index.js only re-exports resource modules.
- The MCP URL is taken from the environment, sync is skipped when the URL or token is missing, and fetch errors do not fail the install.
- Skill copies stay inside the command-center and mainsequence namespaces and reject symbolic links and parent-directory paths.
- child_process helpers live in CLI maintenance modules and are not called by postinstall.
Behavioral surface
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./cli/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./cli/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/install-agent-skills.mjsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L377: resolvedProjectDir,
L378: ".agents",
L379: "skills",
...
L428: const skillsParent = dirname(destinationRoot);
L429: await mkdir(skillsParent, { recursive: true });
L430: const stageRoot = await mkdtemp(join(skillsParent, ".command-center-stage-"));
...
L439: const staged = join(stageRoot, ...item.relativePath.split("/"));
L440: await mkdir(dirname(staged), { recursive: true });
L441: await cp(item.source, staged, {
L442: recursive: true,
...
L448:
L449: await mkdir(destinationRoot, { recursive: true });
Write operation from cli/install-agent-skills.mjs:
L377: resolvedProjectDir,
L378: ".agents",
L379: "skills",
...
L428: const skillsParent = dirname(destinationRoot);
L429: await mkdir(skillsParent, { recursive: t
Findings
1 Critical5 High3 Medium4 Low
CriticalAi Agent Control Hijackcli/install-agent-skills.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedstyles.css
HighKnown Malware Source Similaritycli/application-sdk-maintenance.mjs
HighKnown Malware Source Similaritycli/code-repository-sync-local-ops.mjs
HighKnown Malware Source Similaritydist/embed/static-site.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @dev-mainsequence/command-center-sdk@0.5.2.
See all versions of @dev-mainsequence/command-center-sdk for other recorded verdicts.
- Review the evidence and your use of @dev-mainsequence/command-center-sdk@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.