registry / AI-agent control-surface risk / @houseofwolvesllc/claude-scrum-skill

@houseofwolvesllc/claude-scrum-skill

Claude Code skills for scrum project management — PRD to production release pipeline with project scaffolding, sprint planning, status tracking, sprint releases, full-project emulation testing, autonomous orchestration, and project cleanup.

This report shows the evidence for @houseofwolvesllc/claude-scrum-skill@2.8.0. 1 of 5 known versions is blocked or flagged. The newest version, 2.8.1, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an automatic postinstall mutation of Claude Code's global or project skill control surface, including overwriting matching skills and executing copied modules. The lack of network or credential theft does not neutralize the install-hook control-surface hijack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with npm, especially npm install -g.

Impact

It can add or overwrite Claude Code skills in the global user profile or consuming project, changing the agent instructions and executable workflow payload available to Claude Code.

Mechanism

Postinstall copies bundled skills into Claude Code control directories and imports copied workflow modules.

Policy narrative

npm invokes bin/install.js automatically after installation. The script selects either ~/.claude/skills for global installs or the consuming project's .claude/skills directory, then recursively copies its bundled skills, workflows, and guidance there. Matching destination files are overwritten. It subsequently dynamically imports copied workflow modules, so package-controlled code is executed during the lifecycle hook. This changes a broad AI-agent control surface without a separate setup command.

AI rationale

Evidence

package.jsonbin/install.js~/.claude/skills/<project>/.claude/skills/<project>/.gitignore

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs its installer during npm postinstall.
On global installs, it writes into Claude Code's shared ~/.claude/skills directory.
On local installs, it copies bundled skills and workflows into the consuming project's .claude/skills directory, overwriting matching files.
The install hook dynamically imports every copied workflow module as a smoke check.

Evidence against

No network, credential harvesting, shell execution, or self-dependency was found in the installer.
The installer limits its source inputs to bundled skill, workflow, and guidance files.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 332 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-30json

2 "name": "@houseofwolvesllc/claude-scrum-skill",

3 "version": "2.8.0",

4 "description": "Claude Code skills for scrum project management — PRD to production release pipeline with project scaffolding, sprint planning, status tracking, sprint releases, full-project emulation testing, autonomous orchestration, and project cleanup.",

5 "bin": {},

6 "publishConfig": {

7 "access": "public"

8 },

9 "scripts": {

10 "postinstall": "node bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node --test"

12 },

High

Suspicious Lifecycle Evidence

The package automatically runs its installer during npm postinstall.

package.jsonView on unpkg · L9

13 "keywords": [

14 "claude",

15 "claude-code",

16 "skills",

17 "scrum",

18 "sprint",

19 "project-management",

20 "agile",

21 "github-projects"

22 ],

23 "author": "House of Wolves LLC",

24 "license": "Apache-2.0",

25 "repository": {

26 "type": "git",

27 "url": "https://github.com/houseofwolvesllc/claudescrumskill.git"

28 },

29 "homepage": "https://github.com/houseofwolvesllc/claudescrumskill#readme",

30 "bugs": {

README.mdView file

•- **`--skip-on-pause`** (default off) — when a spec's orchestration pauses on a safety gate, mark it skipped and advance to the next spec instead of pausing the queue. Use with caution; safety gates exist for a reason.

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

bin/install.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/workflows/_shared/resolve_worktree_concurrency.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/workflows/_shared/resolve_worktree_concurrency.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

9"scripts": { "postinstall": "node bin/install.js", "test": "node --test" },

High

Suspicious Lifecycle Evidence

The package automatically runs its installer during npm postinstall.

package.jsonView on unpkg · L9

•scripts.postinstall = node bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

README.mdView file

Findings

1 Critical4 High4 Medium3 Low

CriticalAi Agent Control Hijackbin/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighAi Reviewer ManipulationREADME.md

HighSemantic Analysis Limitedlib/workflows/_shared/resolve_worktree_concurrency.mjs#virtual:normalized:round1

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/install.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @houseofwolvesllc/claude-scrum-skill@2.8.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @houseofwolvesllc/claude-scrum-skill@2.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-03 18:04:49.298Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

2.8.1latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 4, 2026, 9:55 PM 2.8.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 3, 2026, 1:12 AM 2.7.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 21, 2026, 12:21 AM 2.6.0SuspiciousAgent extension lifecycle risk

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages