registry / AI-agent control-surface risk / @gotlibr/aisdlc
@gotlibr/aisdlc
Generic workflow builder and offline execution engine
This report shows the evidence for @gotlibr/aisdlc@2.0.1. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic postinstall hook modifies the consuming repository's Claude Code instruction surface. This meets the policy threshold for malicious install-hook abuse even though no network exfiltration was found.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation from within a Git-backed consumer project.
Impact
The package causes Claude Code to load package-provided instructions in the consumer project.
Mechanism
Postinstall writes .agents content and creates a .claude skill symlink.
Policy narrative
On npm installation, the postinstall script uses INIT_CWD to find the consumer repository. It invokes installConsumerAgentSkill, which selects the Claude Code provider. That provider writes a packaged skill under .agents/skills/aisdlc and creates .claude/skills/aisdlc pointing to it. The mutation is automatic and does not require the consumer to run the advertised provider-install command.
AI rationale
The automatic postinstall hook modifies the consuming repository's Claude Code instruction surface. This meets the policy threshold for malicious install-hook abuse even though no network exfiltration was found.
Evidence
package.jsonscripts/postinstall.mjsdist/src/composition/root.jsdist/src/integration/gates.js.agents/skills/aisdlc/SKILL.md.agents/skills/aisdlc/.aisdlc-managed.json.claude/skills/aisdlc
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm postinstall hook runs automatically.
- Postinstall locates the consumer Git repository and installs an agent skill.
- The installer writes a skill under .agents and creates a .claude skill symlink.
- This mutates a foreign AI-agent control surface without an explicit user command.
Evidence against
- No network client or endpoint was found in the inspected install path.
- Native loading verifies platform identity and SHA-256 before requiring the binary.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgnative/prebuild-contract.cjsView file
2L3: const { createHash } = require('node:crypto');
L4: const { existsSync, readFileSync } = require('node:fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
native/prebuild-contract.cjsView on unpkg · L2Findings
2 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/node_modules/ajv/dist/refs/data.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirenative/prebuild-contract.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynative/prebuilds/linux-x64-napi9/aisdlc_native.node
MediumOversized Source Filedist/node_modules/typescript/lib/typescript.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @gotlibr/aisdlc@2.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @gotlibr/aisdlc@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.