Loading npm security reports…

@g7e6-sdlc/sdlc-cli@1.2.0: AI-agent control-surface risk | LPM Firewall

registry / @g7e6-sdlc/sdlc-cli / 1.2.0

@g7e6-sdlc/sdlc-cli@1.2.0

SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配

AI Security Review

scanned 1h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically overwrites matching skills in broad Claude and agent skill directories. It also creates local configuration and may establish a recurring collector that sends queued events.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall invokes dist/cli.js install automatically.

Impact

Package content can become active instructions for installed AI-agent environments without an explicit setup command; matching existing skill directories are removed first.

Mechanism

Automatic foreign AI-agent skill overwrite with optional user-level scheduled telemetry.

Policy narrative

On installation, npm runs the package install command without user interaction. The command creates configuration, removes matching directories under the user's Claude and generic agent skill roots, then copies package-controlled skills there. It also attempts to create a recurring collector task; when active, that task flushes queued events to the configured knowledge-base server. The scheduler has a global-binary guard, but the foreign AI-agent skill mutation is unconditional in the install command.

Rationale

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces, with overwrite semantics and related persistence/network behavior. The lifecycle guard on scheduling does not neutralize the automatic skill installation.

Evidence

package.jsondist/cli.js~/.claude/skills/<bundled-skill>~/.agents/skills/<bundled-skill>~/.sdlc/config.yaml~/.config/systemd/user/sdlc-kb-collector-flush.service

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli.js install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli.js install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

70import { L71: cpSync, L72: existsSync, L73: mkdirSync, L74: readdirSync, ... L77: symlinkSync, L78: writeFileSync L79: } from "fs"; ... L84: function mkdirp(path) { L85: mkdirSync(path, { recursive: true }); L86: } ... L91: function copyDir(src, dest) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli.jsView on unpkg · L70

41Trigger-reachable persistence chain: scripts.postinstall -> dist/cli.js L41: // src/util/errors.ts L42: var ExitCode = { L43: Success: 0, ... L119: function expandTilde(p) { L120: if (p === "~") return homedir(); L121: if (p.startsWith("~/")) return join(homedir(), p.slice(2)); ... L175: function configPath() { L176: return process.env.SDLC_CONFIG ?? join2(homedir2(), ".sdlc", "config.yaml"); L177: } ... L190: writeYaml(path, cfg); L191: ensureConfigFilePrivate(path); L192: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L41

41// src/util/errors.ts L42: var ExitCode = { L43: Success: 0, ... L119: function expandTilde(p) { L120: if (p === "~") return homedir(); L121: if (p.startsWith("~/")) return join(homedir(), p.slice(2)); ... L175: function configPath() { L176: return process.env.SDLC_CONFIG ?? join2(homedir2(), ".sdlc", "config.yaml"); L177: } ... L190: writeYaml(path, cfg); L191: ensureConfigFilePrivate(path); L192: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L41

41// src/util/errors.ts L42: var ExitCode = { L43: Success: 0, ... L119: function expandTilde(p) { L120: if (p === "~") return homedir(); L121: if (p.startsWith("~/")) return join(homedir(), p.slice(2)); ... L175: function configPath() { L176: return process.env.SDLC_CONFIG ?? join2(homedir2(), ".sdlc", "config.yaml"); L177: } ... L190: writeYaml(path, cfg); L191: ensureConfigFilePrivate(path); L192: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L41

skills/importing-artifacts/scripts/scan_source.pyView file

•path = skills/importing-artifacts/scripts/scan_source.py kind = build_helper sizeBytes = 5479 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/importing-artifacts/scripts/scan_source.pyView on unpkg