registry  /  @g7e6-sdlc/sdlc-cli  /  0.7.0

@g7e6-sdlc/sdlc-cli@0.7.0

SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package invokes its CLI automatically. The CLI writes a default config and replaces package-named skill directories in two foreign AI-agent skill roots.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
Package installation mutates broad user-level AI-agent control surfaces without an explicit user command.
Mechanism
lifecycle-driven AI-agent skill replacement
Policy narrative
During npm postinstall, the package executes `install`. It creates `~/.sdlc/config.yaml` if absent and removes then copies its bundled skills into both `~/.claude/skills` and `~/.agents/skills`. This is an unconsented install-time mutation of foreign, user-level AI-agent instruction/control directories; no exfiltration or remote payload chain was confirmed.
Rationale
The source confirms the scanner’s central finding: an automatic npm lifecycle hook modifies broad AI-agent skill roots. Transparency in the README and absence of exfiltration reduce ambiguity but do not remove the prohibited control-surface mutation.
Evidence
package.jsondist/cli.jsREADME.mdskills/using-sdlc-cli/SKILL.mdskills/configuring-sdlc/SKILL.mdskills/using-sdlc-cliskills/configuring-sdlc~/.sdlc/config.yaml~/.claude/skills/using-sdlc-cli~/.claude/skills/configuring-sdlc~/.agents/skills/using-sdlc-cli~/.agents/skills/configuring-sdlc

Decision evidence

public snapshot
AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for policy block
  • `package.json` runs `node ./dist/cli.js install` at `postinstall`.
  • `dist/cli.js` copies bundled `skills/` into `~/.claude/skills` and `~/.agents/skills`.
  • The install path removes each existing same-named target skill before replacing it.
Evidence against
  • `dist/cli.js` skips its global npm self-install when invoked by `postinstall`.
  • No HTTP URL literals, fetch APIs, credential harvesting, eval, or dynamic loading were found.
  • `README.md` openly documents the lifecycle writes and skill targets.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 1 file(s), 78.5 KB of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./dist/cli.js install || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./dist/cli.js install || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli.jsView file
1Install-time AI-agent control hijack evidence: L67: import { L68: cpSync, L69: existsSync, L70: mkdirSync, L71: readdirSync, ... L73: rmSync, L74: writeFileSync L75: } from "fs"; ... L80: function mkdirp(path) { L81: mkdirSync(path, { recursive: true }); L82: } ... L87: function copyDir(src, dest) { Payload evidence from skills/configuring-sdlc/SKILL.md: L1: --- L2: name: configuring-sdlc
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/cli.jsView on unpkg · L1

Findings

1 Critical1 High4 Medium3 Low
CriticalAi Agent Control Hijackdist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License