registry  /  @g7e6-sdlc/sdlc-cli  /  0.2.0

@g7e6-sdlc/sdlc-cli@0.2.0

SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Confirmed install-time mutation of AI-agent control surfaces. The package postinstall invokes the CLI installer, which copies package-controlled skills into Claude and agent skill directories and overwrites existing same-named skill directories.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / package postinstall
Impact
Package-controlled instructions become available to local AI agents after install; existing same-named skills may be removed and replaced.
Mechanism
unconsented lifecycle installation of AI-agent skill files
Policy narrative
On installation, npm runs `node ./dist/cli.js install || true`. That command creates a config template if needed, enumerates bundled skill directories with SKILL.md, removes any existing matching destinations, and copies those package-supplied skills into ~/.claude/skills and ~/.agents/skills. This is an install-time write to AI-agent instruction surfaces without an explicit user CLI action beyond package installation.
Rationale
Although the bundled skills look aligned with the CLI, writing package-controlled AI-agent skills during postinstall is an unconsented lifecycle mutation of agent control files. No exfiltration was found, but the confirmed install-time agent-control behavior warrants blocking under the firewall policy. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsondist/cli.jsskills/using-sdlc-cli/SKILL.mdskills/configuring-sdlc/SKILL.md~/.sdlc/config.yaml~/.claude/skills/using-sdlc-cli~/.claude/skills/configuring-sdlc~/.agents/skills/using-sdlc-cli~/.agents/skills/configuring-sdlc

Decision evidence

public snapshot
AI called this Malicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for policy block
  • package.json defines postinstall: node ./dist/cli.js install || true
  • dist/cli.js install command runs on postinstall and calls installSkills()
  • dist/cli.js defaultSkillTargets() resolves to ~/.claude/skills and ~/.agents/skills unless SDLC_SKILLS_HOME is set
  • dist/cli.js installSkills() removes each existing target skill directory then copies bundled package skills into agent skill paths
  • dist/cli.js also creates ~/.sdlc/config.yaml template during install if absent
Evidence against
  • No hardcoded exfiltration endpoint or credential harvesting found
  • Network/git operations are tied to explicit CLI workspace commands or user configured remotes
  • Global npm self-install is skipped during npm_lifecycle_event=postinstall
  • Bundled skill files appear to document sdlc-cli usage/configuration rather than hide payload code
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 1 file(s), 59.2 KB of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./dist/cli.js install || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./dist/cli.js install || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli.jsView file
1Install-time AI-agent control hijack evidence: L67: import { L68: cpSync, L69: existsSync, L70: mkdirSync, L71: readdirSync, ... L73: rmSync, L74: writeFileSync L75: } from "fs"; ... L80: function mkdirp(path) { L81: mkdirSync(path, { recursive: true }); L82: } ... L87: function copyDir(src, dest) { Payload evidence from skills/configuring-sdlc/SKILL.md: L1: --- L2: name: configuring-sdlc
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/cli.jsView on unpkg · L1

Findings

1 Critical1 High4 Medium3 Low
CriticalAi Agent Control Hijackdist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License