Loading npm security reports…

@jenga-ai/agent@1.3.0: AI-agent control-surface risk | LPM Firewall

registry / @jenga-ai/agent / 1.3.0

@jenga-ai/agent@1.3.0

Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically mutates a consumer project's AI-agent discovery paths and Copilot instruction file. The generated instructions can direct Copilot to run package-provided skill procedures and shell commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation

Impact

A package installation changes the consumer's AI-agent control surface without an explicit setup command.

Mechanism

Postinstall copies agent content and writes mandatory Copilot routing instructions

Policy narrative

The postinstall hook runs during npm installation, mirrors package-controlled skills and agents into `.claude` and `.agents`, and writes `.github/copilot-instructions.md` without prompting. That file instructs Copilot to load matched skills and execute their instructions, including shell commands, exactly as written. This creates an unconsented, package-controlled AI-agent execution path in the consumer project.

AI rationale

This is concrete install-time mutation of broad, foreign AI-agent control surfaces, followed by instructions that suppress independent judgment and enable package-provided command execution. It meets the install-hook abuse blocking policy despite no observed network exfiltration.

Evidence

package.jsonscripts/postinstall.jslib/generate-copilot-instructions.jstemplates/copilot-instructions.md.tpl.claude/skills/.claude/agents/.agents/skills/.agents/agents/.github/copilot-instructions.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"scripts": { "postinstall": "node scripts/postinstall.js", "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L15

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

6* Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH L7: * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/` L8: * (where non-Claude agents like Copilot / custom look, per the framework's ... L112: L113: // Discovery-bound dirs get mirrored to both .claude/ (Claude Code) and L114: // .agents/ (Copilot / custom). Everything else is sourced from L115: // node_modules/jenga-agent/… at runtime — no duplication. L116: const copySet = ['skills', 'agents']; L117: const targetRoots = ['.claude', '.agents']; L118: ... L160: // the separate `jenga init` CLI wizard) gets no `/skill-name` routing instructions at all L161: // (E46_S03_T01). `.agents/skills` is passed as the skills directory because that's the

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 19956 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@jenga-ai/agent",

3 "version": "1.3.0",

4 "description": "Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "jenga": "./bin/jenga.js"

11 },

12 "engines": {

13 "node": ">=14.13.1"

14 },

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L15

18 "validate:npm-metadata": "bash scripts/validate_npm_metadata.sh",

19 "ui:dev": "npm run ui:dev --prefix project/app --",

20 "ui:build": "npm run ui:build --prefix project/app --",

21 "api:start": "npm run api:start --prefix project/app --",

22 "api:dev": "npm run api:dev --prefix project/app --",

23 "dashboard:start": "npm run dashboard:start --prefix project/app --",

24 "dashboard:open": "npm run dashboard:open --prefix project/app --"

25 },

26 "files": [

27 "skills/",

28 "agents/",

29 "hooks/",

30 "scripts/",

31 "templates/",

32 "bin/",

33 "lib/",

34 "mcp/execute-ticket/*.js",

35 "mcp/execute-ticket/package.json",

36 "mcp/help/*.js",

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * postinstall.js — Jenga AI consumer installation hook

4 *

5 * Runs automatically when a consumer project installs jenga-agent via npm.

6 * Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH

7 * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/`

8 * (where non-Claude agents like Copilot / custom look, per the framework's

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 19956 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg