Loading npm security reports…

@hunpeolabs/ai-agent-kit: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 1.7.1

@hunpeolabs/ai-agent-kit@1.7.1

The governed agent operating system that turns rough product ideas into approved requirements, specifications, delivery, and evidence-backed software.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall lifecycle automatically modifies the consumer repository's instruction files for multiple AI agents. The installer supplies automatic approval without a separate user setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A local project installation that passes the installer checks and lacks .ai-agent-kit/installation.json.

Impact

Package-supplied instructions become part of the consumer project's broad AI-agent control surface without explicit setup consent.

Mechanism

Postinstall calls the CLI bootstrap command with --non-interactive and --yes; bootstrap selects all adapters and persists managed agent instructions.

Policy narrative

Installing the package in an eligible consumer project activates postinstall. The hook supplies noninteractive automatic approval to bootstrap, which defaults to every agent adapter and writes managed instructions into multiple agent instruction files. Existing activation checks and file safeguards limit execution and overwrites, but do not obtain consent for this install-time control-surface mutation.

AI rationale

Inspected source establishes unconsented npm postinstall mutation of a broad AI-agent control surface, which meets the blocking policy. The decision rests on the executable installation chain, not scanner similarity labels.

Evidence

package.jsondist/bin/postinstall.mjsdist/src/postinstall.mjsdist/src/cli.mjsdist/src/bootstrap.mjsdist/src/file-ops.mjsdist/src/adapters.mjs

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli.mjsView file

725Install-time code directly mutates a foreign AI-agent control surface: L725: const content = withMemoryStore(options, (store) => store.exportEntries(options)); L726: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, content, { mode: 0o600 }); L727: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), sha256: crypto.createHash("sha256").update(content).digest("hex") }; ... L740: const { artifact: output, relative } = resolveMemoryArtifactPath(options, options.output, "memory pack output"); L741: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, `${JSON.stringify(pack, null, 2)}\n`, { mode: 0o600 }); L742: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/cli.mjsView on unpkg · L725

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.4.1 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/memory-contract.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.4.1 matchedPath = dist/src/memory-contract.mjs matchedIdentity = npm:[redacted]:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-contract.mjsView on unpkg

dist/src/memory-lifecycle.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.4.1 matchedPath = dist/src/memory-lifecycle.mjs matchedIdentity = npm:[redacted]:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-lifecycle.mjsView on unpkg

dist/src/product-genesis.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.6.0 matchedPath = dist/src/product-genesis.mjs matchedIdentity = npm:[redacted]:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/product-genesis.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.4.1 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

dist/src/pulse-reporters.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.4.1 matchedPath = dist/src/pulse-reporters.mjs matchedIdentity = npm:[redacted]:1.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/pulse-reporters.mjsView on unpkg