registry  /  @g7e6-sdlc/sdlc-cli  /  0.7.1

@g7e6-sdlc/sdlc-cli@0.7.1

SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package automatically invokes `sdlc-cli install`. It writes a config if absent and deletes/replaces packaged skills under both Claude and generic agent skill directories.

Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm `postinstall` during package installation
Impact
Mutates broad AI-agent control surfaces and can alter agent behavior outside the package project.
Mechanism
Unconsented lifecycle deployment of bundled AI-agent skills
Policy narrative
The package runs its `install` command automatically during npm postinstall. That command discovers bundled skill directories, removes identically named directories in `~/.claude/skills` and `~/.agents/skills`, and copies in package-controlled agent instructions without an explicit user command. This is an install-time mutation of broad, foreign AI-agent control surfaces; the package’s otherwise local configuration and workspace functions do not remove that risk.
Rationale
Source inspection confirms unconsented postinstall writes to broad AI-agent skill roots. Policy requires blocking this concrete lifecycle control-surface mutation even though no credential exfiltration or remote payload execution was found.
Evidence
package.jsondist/cli.jsskills/configuring-sdlc/SKILL.mdskills/using-sdlc-cli/SKILL.md~/.sdlc/config.yaml~/.claude/skills/configuring-sdlc~/.claude/skills/using-sdlc-cli~/.agents/skills/configuring-sdlc~/.agents/skills/using-sdlc-cli

Decision evidence

public snapshot
AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for policy block
  • `package.json` runs `node ./dist/cli.js install || true` in `postinstall`.
  • `dist/cli.js` resolves default targets to `~/.claude/skills` and `~/.agents/skills`.
  • `installSkills` recursively removes then replaces each bundled skill directory at both targets.
  • The automatic install path invokes skill copying without user interaction.
  • Bundled `SKILL.md` files contain agent-operational instructions and are deployed to broad agent skill roots.
  • The lifecycle command suppresses failures with `|| true`, reducing visibility of its mutations.
Evidence against
  • `dist/cli.js` skips its optional global npm self-install when `npm_lifecycle_event` is `postinstall`.
  • No hardcoded HTTP endpoint, credential harvesting, or exfiltration path was found in inspected sources.
  • Git network operations are CLI workspace features driven by configured/user-supplied repository addresses.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 1 file(s), 78.5 KB of source

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./dist/cli.js install || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./dist/cli.js install || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli.jsView file
1Install-time AI-agent control hijack evidence: L67: import { L68: cpSync, L69: existsSync, L70: mkdirSync, L71: readdirSync, ... L73: rmSync, L74: writeFileSync L75: } from "fs"; ... L80: function mkdirp(path) { L81: mkdirSync(path, { recursive: true }); L82: } ... L87: function copyDir(src, dest) { Payload evidence from skills/configuring-sdlc/SKILL.md: L1: --- L2: name: configuring-sdlc
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/cli.jsView on unpkg · L1
•matchType = malicious_source_fingerprint_signature signature = bf2bf62b476c4fac signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @g7e6-sdlc/sdlc-cli@0.7.0 matchedPath = dist/cli.js matchedIdentity = npm:QGc3ZTYtc2RsYy9zZGxjLWNsaQ:0.7.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

Findings

1 Critical2 High4 Medium3 Low
CriticalAi Agent Control Hijackdist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturedist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License