registry / AI-agent control-surface risk / @kyh/skills
@kyh/skills
Personal Claude Code + Codex skills, agents, MCP servers, and global instructions. Symlinks into a canonical ~/.agents store (and ~/.claude) on install.
This report shows the evidence for @kyh/skills@0.1.4. 3 of 5 known versions are blocked or flagged. The newest version, 0.2.1, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concrete postinstall chain that injects package content into shared AI-agent directories and installs external skills globally. Under the install-control-surface policy, this requires blocking rather than treating the lifecycle hook as benign setup.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
`npm install -g @kyh/skills` runs the postinstall hook.
Impact
Package-controlled instructions and externally fetched skills become available to multiple AI coding agents across projects.
Mechanism
postinstall global AI-agent config injection and third-party skill installation
Policy narrative
On global installation, the postinstall script links package-supplied skills, agents, and global instructions into shared `~/.agents` and `~/.claude` locations used by multiple AI coding tools. It additionally runs a package-manager-backed skills installer against 14 external repositories with global scope. This is an unconsented lifecycle-hook mutation of a broad AI-agent control surface, even though it provides opt-outs and its current MCP list is empty.
AI rationale
Source inspection confirms a concrete postinstall chain that injects package content into shared AI-agent directories and installs external skills globally. Under the install-control-surface policy, this requires blocking rather than treating the lifecycle hook as benign setup.
Evidence
package.jsonscripts/link.mjsexternal-skills.jsonmcp.jsonCLAUDE.mdagents/*.mdskills/*~/.agents/skills/*~/.agents/agents/*~/.claude/skills/*~/.claude/agents/*~/.claude/CLAUDE.md~/.claude.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- `package.json` runs `scripts/link.mjs` as `postinstall`.
- `scripts/link.mjs` writes package skills and agents into `~/.agents`, read by several AI agents.
- The lifecycle script mirrors content into `~/.claude` and links package `CLAUDE.md` globally.
- It invokes `skills add <repo> -g -s * -y` for 14 third-party repos during postinstall.
- It alters `~/.claude.json` MCP configuration when package-supplied servers exist.
Evidence against
- Postinstall skips ordinary local installs unless `KYH_SKILLS_FORCE` is set.
- The bundled `mcp.json` currently has an empty `mcpServers` object.
- Existing destination files are backed up rather than silently deleted.
- No direct credential harvesting or explicit exfiltration code was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/link.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/link.mjsView file
7Install-time AI-agent control hijack evidence:
L7: // 2. Non-universal agents (claude) get their own dirs symlinked to the canonical
L8: // store: ~/.claude/skills/<name> -> ~/.agents/skills/<name>, etc.
L9: // 3. CLAUDE.md -> ~/.claude/CLAUDE.md and mcp.json merged into ~/.claude.json.
L10: // 4. External skill repos in external-skills.json are installed globally with
...
L35: const AGENTS_DIR = path.join(HOME, ".agents"); // canonical store (read directly by universal agents)
L36: const CLAUDE_DIR = path.join(HOME, ".claude"); // non-universal: symlinks into the canonical store
L37:
...
L69: await step(installExternalSkills); // npx skills add <repo> ... -> ~/.agents (parallel)
L70: await step(linkClaude); // mirror everything in ~/.agents -> ~/.claude (incl. external)
L71: a
Critical
Ai Agent Control Hijack
Install-time source drops package-supplied AI-agent/MCP control files or instructions.
scripts/link.mjsView on unpkg · L7Findings
1 Critical6 High2 Medium3 Low
CriticalAi Agent Control Hijackscripts/link.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/link.mjs
HighShell
HighRuntime Package Installscripts/link.mjs
HighKnown Malware Source Similarityscripts/link.mjs
HighKnown Malware Source Fingerprint Signaturescripts/link.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @kyh/skills@0.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @kyh/skills@0.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions0.2.1latestClean—AllowPublishedOct 11, 2026, 2:55 AM0.1.5SuspiciousAgent extension lifecycle riskWarnPublishedJul 25, 2026, 2:58 AM0.1.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 18, 2026, 9:10 AM0.1.3MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 18, 2026, 12:01 AM