@goobit/ai@0.0.2
AI Git Collaboration Governance & Smart Skill Hub for Heterogeneous AI Agents
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s automatic postinstall performs unconsented writes to project-level AI agent control files. This meets the policy for blocking lifecycle-triggered mutation of a foreign AI control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package into an external project with INIT_CWD set.
Impact
The install can alter instructions consumed by AI agents in the project and overwrite existing directives.
Mechanism
The postinstall hook invokes setupGovernance for INIT_CWD, which writes AGENTS.md and harness-specific instruction files without checking for user consent or preserving existing content.
Policy narrative
During installation in an external project, the postinstall hook automatically invokes setupGovernance on INIT_CWD. That function writes an AGENTS.md constitution and redirects Claude, Cursor, and Gemini project instructions to it, overwriting those paths if they already exist. No affirmative setup consent is checked.
AI rationale
The package’s automatic postinstall performs unconsented writes to project-level AI agent control files. This meets the policy for blocking lifecycle-triggered mutation of a foreign AI control surface.
Evidence
package.jsonbin/postinstall.jsbin/harness-bridge.jsAGENTS.mdCLAUDE.md.cursorrules.gemini/rules/project.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs a postinstall script automatically.
- The hook targets the external project in INIT_CWD and calls setupGovernance without an affirmative consent check.
- Setup writes AGENTS.md and harness instruction files into the target project, including Claude, Cursor, and Gemini configuration locations.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg14"postinstall": "node ./bin/postinstall.js",
"push": "node ./bin/harness-bridge.js push",
"pull": "node ./bin/harness-bridge.js pull",
"list": "node ./bin/harness-bridge
High
Suspicious Lifecycle Evidence
The package runs a postinstall script automatically.
package.jsonView on unpkg · L14•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/harness-bridge.jsView file
4Install-time code directly mutates a foreign AI-agent control surface:
L8: * 1. Auto-seeding: Works out of the box even in brand-new folders without 'skills' branch!
L9: * 2. Generates universal 'AGENTS.md' (Git branching, commit, push, PR/merge rules)
L10: * 3. Bridges all AI harnesses (Claude, Cursor, Gemini, Copilot) to AGENTS.md
L11: * 4. Synchronizes universal skills into '.agents/skills/'
L12: * 5. Deploys GitHub PR Template for merge gating
...
L62: if (!fs.existsSync(dirPath)) {
L63: fs.mkdirSync(dirPath, { recursive: true });
L64: }
...
L75: } else {
L76: fs.copyFileSync(srcPath, destPath);
L77: }
...
L90: const patterns = [
Write operation from bin/harness-bridge.js:
L8: * 1. Auto-seeding: Works out of the box even in brand-new folders without 'skills' branch!
L9: *
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/harness-bridge.jsView on unpkg · L4•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
e('crypto');
const { execsync } = require('child_process');
const governance_branch = 'skills';
const assets_dir = path.join(__dirname, '..', 'assets');
function getrootdir() {
return process.env.init_cwd || process.cwd();
}
function rungit(command, targetdir, options = {}) {
try {
return execsync(`git ${command}`, {
cwd: targetdir || getrootdir(),
encoding: 'utf-8',
stdio: ['pipe', 'pipe', 'pipe'],
...options
}).trim();
} catch (err) {
if (options.ignoreerror) return null;
throw new error(`git command failed: git ${command}\n${err.stderr || err.message}`);
}
}
function checkbranchexists(branchname,
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/harness-bridge.jsView on unpkg19const crypto = require('crypto');
L20: const { execSync } = require('child_process');
L21:
L22: const GOVERNANCE_BRANCH = 'skills';
L23: const ASSETS_DIR = path.join(__dirname, '..', 'assets');
L24:
...
L27: function getRootDir() {
L28: return process.env.INIT_CWD || process.cwd();
L29: }
...
L40: if (options.ignoreError) return null;
L41: throw new Error(`Git command failed: git ${command}\n${err.stderr || err.message}`);
L42: }
Low
Weak Crypto
Package source references weak cryptographic algorithms.
bin/harness-bridge.jsView on unpkg · L19bin/postinstall.jsView file
11const targetDir = process.env.INIT_CWD;
// Only run if installed into an external project (avoid self-trigger during development)
if (targetDir && targetDir !== __dirname && targetDir !== p
High
Ai Review Evidence
The hook targets the external project in INIT_CWD and calls setupGovernance without an affirmative consent check.
bin/postinstall.jsView on unpkg · L11Findings
1 Critical4 High3 Medium4 Low
CriticalAi Agent Control Hijackbin/harness-bridge.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/harness-bridge.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencebin/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptobin/harness-bridge.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @goobit/ai@0.0.2.
See all versions of @goobit/ai for other recorded verdicts.
- Avoid installing @goobit/ai@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.