@ghl-ai/aw@0.1.93
Agentic Workspace CLI — pull, push & manage agents, skills and commands from the registry
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no automatic install-time hook or self-dependency chain, but its automatic uninstall hook performs broad and insufficiently ownership-checked deletion in AI-agent control surfaces. This is a dangerous uninstall capability rather than confirmed malware.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm uninstall of the package
Impact
Potential deletion of unrelated agent skills, registry links, hooks, and MCP or routing configuration.
Mechanism
Automatic destructive cleanup of home-directory agent configuration and content
AI rationale
The package has no automatic install-time hook or self-dependency chain, but its automatic uninstall hook performs broad and insufficiently ownership-checked deletion in AI-agent control surfaces. This is a dangerous uninstall capability rather than confirmed malware.
Evidence
package.jsoncommands/nuke.mjs~/.claude~/.cursor~/.codex~/.agents~/.aw_registry~/.aw
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package automatically runs its nuke command during npm uninstall.
- The uninstall cleanup recursively deletes any directory containing SKILL.md under several AI-agent directories, without verifying it was created by this package.
- The cleanup scans the home directory for registry links and legacy hooks, then removes matches.
- The uninstall path removes managed startup hooks, MCP configuration, and a context-mode integration.
Evidence against
- There is no preinstall, install, or postinstall lifecycle hook.
- There is no runtime dependency on this package itself.
- The remote installer and daemon capabilities are reached through explicit CLI commands, not package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedmcp.mjsView file
4import { existsSync, writeFileSync, readFileSync, mkdirSync, renameSync } from 'node:fs';
L5: import { execSync } from 'node:child_process';
L6: import { createInterface } from 'node:readline';
High
4import { existsSync, writeFileSync, readFileSync, mkdirSync, renameSync } from 'node:fs';
L5: import { execSync } from 'node:child_process';
L6: import { createInterface } from 'node:readline';
...
L12:
L13: const HOME = homedir();
L14: export const DEFAULT_MCP_URL = 'https://services.leadconnectorhq.com/agentic-workspace/mcp';
L15: const MCP_PREFS_FILENAME = 'mcp-preferences.json';
...
L28: try {
L29: return JSON.parse(readFileSync(filePath, 'utf8'));
L30: } catch {
...
L43:
L44: function envDisablesMcp(env = process.env) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
mcp.mjsView on unpkg · L4integrations.mjsView file
27L28: const execAsync = promisify(exec);
L29: const HOME = homedir();
Findings
2 Critical6 High6 Medium5 Low
CriticalDownload Executeintegrations.mjs#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilityintegrations.mjs#virtual:normalized:round1
HighChild Processmcp.mjs
HighShellintegrations.mjs
HighSandbox Evasion Gated Capabilitymcp.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationstartup.mjs
HighTrigger Reachable Persistencecommands/daemon.mjs
HighSemantic Analysis Limitedc4/initRepo.mjs#virtual:normalized:round1
MediumDynamic Requirecommands/init.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencecommands/daemon.mjs
Affected versions and remediation
This report applies to @ghl-ai/aw@0.1.93.
See all versions of @ghl-ai/aw for other recorded verdicts.
- Review the evidence and your use of @ghl-ai/aw@0.1.93 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.