registry / @dev-mainsequence/command-center-sdk / 0.5.8
@dev-mainsequence/command-center-sdk@0.5.8
The framework-neutral SDK for building Command Center-compatible resource applications, navigation, layouts, themes, feedback, and embeds.
AI Security Review
scanned 24d ago · by lpm-firewall-aiAutomatic postinstall agent-skill mutation and environment-configurable authenticated remote skill retrieval create a concrete guarded extension risk. The inspected code does not show a completed malicious payload or broad unnamespaced control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall during package installation, with MCP synchronization additionally requiring configured endpoint and token variables.
Impact
This is a guarded first-party agent-extension lifecycle risk; no confirmed malicious attack was established, but remote skill content can affect later agent behavior.
Mechanism
The installer writes namespaced skills under .agents and posts MCP requests using an environment-selected HTTP(S) URL and bearer token.
AI rationale
Automatic postinstall agent-skill mutation and environment-configurable authenticated remote skill retrieval create a concrete guarded extension risk. The inspected code does not show a completed malicious payload or broad unnamespaced control-surface mutation.
Evidence
package.jsoncli/postinstall.mjscli/install-agent-skills.mjscli/install-mcp-skills.mjscli/mcp-platform-skills.mjs.agents/skills/command-center.agents/skills/mainsequence
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package declares an automatic postinstall entrypoint.
- Postinstall installs package-provided agent skills into the consumer repository.
- The installer targets a namespaced .agents skills directory.
- When MCP configuration is available, postinstall fetches a remote skill catalog.
- MCP URL selection accepts environment-provided HTTP(S) endpoints.
- MCP requests send the configured access token as a bearer credential.
Evidence against
- The remote synchronization path is skipped when MCP configuration is absent.
- The observed destinations are namespaced skill directories, not arbitrary project paths.
- No self-dependency or arbitrary code execution sink was found in the inspected paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./cli/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./cli/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/install-agent-skills.mjsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L388: async function acquireInstallLock(skillsParent) {
L389: await mkdir(skillsParent, { recursive: true });
L390: const lockPath = join(skillsParent, INSTALL_LOCK_FILENAME);
...
L449: resolvedProjectDir,
L450: ".agents",
L451: "skills",
...
L534: const staged = join(stageRoot, ...item.relativePath.split("/"));
L535: await mkdir(dirname(staged), { recursive: true });
L536: await cp(item.source, staged, {
L537: recursive: true,
...
L543:
L544: await mkdir(destinationRoot, { recursive: true });
Write operation from cli/install-agent-skills.mjs:
L388: async function acquireInstallLock(skillsParent) {
L389: await mkdir(skillsParent, { recursive: true });
L390: const lockPath = join(skillsParent, INSTALL_LOCK_FILENAME);
..
Findings
1 Critical4 High4 Medium4 Low
CriticalAi Agent Control Hijackcli/install-agent-skills.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedstyles.css
HighKnown Malware Source Similaritycli/application-sdk-maintenance.mjs
HighKnown Malware Source Similaritycli/code-repository-sync-local-ops.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @dev-mainsequence/command-center-sdk@0.5.8.
See all versions of @dev-mainsequence/command-center-sdk for other recorded verdicts.
- Review the evidence and your use of @dev-mainsequence/command-center-sdk@0.5.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.