Loading npm security reports…

@glenmaura/axe-skills@2.0.0: AI-agent control-surface risk | LPM Firewall

registry / @glenmaura/axe-skills / 2.0.0

@glenmaura/axe-skills@2.0.0

AXE Claude Code skills + slash commands installer — 246 skills, 38 commands

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently changes a user's global Claude Code configuration and installs agent content. The resulting MCP entry can automatically fetch and run a separate package when Claude Code starts it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation triggers postinstall.

Impact

A dependency install can add an unconsented agent tool and execute its package through npx in the user's Claude Code environment.

Mechanism

Postinstall copies agent files and patches the global MCP server configuration.

Policy narrative

On npm installation, postinstall invokes the installer silently. It copies package-supplied commands and skills into global Claude Code directories, then writes an axe MCP server entry to ~/.claude.json. That entry uses npx -y to obtain and execute @axe/mcp when the MCP server is launched. This is an unconsented install-time mutation of a foreign AI-agent control surface and creates a remote executable extension path.

Rationale

The package performs unconsented postinstall mutation of global Claude Code files and injects an MCP server that automatically installs another package. This meets the blocking policy for foreign AI-agent control-surface mutation.

Evidence

package.jsonbin/axe-skills.js~/.claude/commands~/.claude/skills~/.claude.json

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/axe-skills.js install --silent

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"scripts": { "postinstall": "node bin/axe-skills.js install --silent" }

High

Suspicious Lifecycle Evidence

A postinstall hook runs the installer without user interaction.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/axe-skills.js install --silent

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/axe-skills.jsView file

7* npx @axe/skills status show what's installed L8: * npx @axe/skills mcp print the MCP config block for ~/.claude.json L9: * npx @axe/skills update re-run install (safe to run multiple times) ... L18: const HOME = os.homedir(); L19: const CLAUDE_DIR = path.join(HOME, '.claude'); L20: const COMMANDS_DEST = path.join(CLAUDE_DIR, 'commands'); L21: const SKILLS_DEST = path.join(CLAUDE_DIR, 'skills'); L22: const CLAUDE_JSON = path.join(HOME, '.claude.json'); L23: ... L31: function ensureDir(p) { L32: if (!fs.existsSync(p)) fs.mkdirSync(p, { recursive: true }); L33: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/axe-skills.jsView on unpkg · L7

18const HOME = os.homedir(); const CLAUDE_DIR = path.join(HOME, '.claude'); const COMMANDS_DEST = path.join(CLAUDE_DIR, 'commands'); const SKILLS_DEST = path.join(CLAUDE_DIR, 'skills'); const CLAUDE_JSON = path.join(HOME, '.claude.json');

High

Ai Review Evidence

The installer writes AXE commands and skills into the user's Claude Code directories.

bin/axe-skills.jsView on unpkg · L18

35function installCommands(silent) { ensureDir(COMMANDS_DEST); const files = fs.readdirSync(COMMANDS_SRC).filter((f) => f.endsWith('.md')); let count = 0; for (const f of files) { const src = path.join(COMMANDS_SRC, f); const dest = path.join(COMMANDS_DEST, f); fs.copyFileSync(src, dest); count++;

High

Ai Review Evidence

The installer writes AXE commands and skills into the user's Claude Code directories.

bin/axe-skills.jsView on unpkg · L35

78if (!config.mcpServers) config.mcpServers = {}; const existing = config.mcpServers[AXE_MCP_KEY]; const alreadyNpx = existing && existing.command === 'npx'; if (!alreadyNpx) { config.mcpServers[AXE_MCP_KEY] = AXE_MCP_ENTRY; fs.writeFileSync(CLAUDE_JSON, JSON.stringify(config, null, 2) + '\n'); if (!silent) console.log(` mcp: patched ${CLAUDE_JSON} → mcpServers.${AXE_MCP_KEY}`);

High

Ai Review Evidence

It modifies the global Claude Code MCP configuration.

bin/axe-skills.jsView on unpkg · L78

skills/axe-docs/scripts/docx_tools.pyView file

•path = skills/axe-docs/scripts/docx_tools.py kind = build_helper sizeBytes = 3792 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/axe-docs/scripts/docx_tools.pyView on unpkg