Loading npm security reports…

@kyh/skills@0.1.4: AI-agent policy block | LPM Firewall

registry / @kyh/skills / 0.1.4

@kyh/skills@0.1.4

Personal Claude Code + Codex skills, agents, MCP servers, and global instructions. Symlinks into a canonical ~/.agents store (and ~/.claude) on install.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. A global npm install automatically mutates broad, shared AI-agent configuration directories. It also downloads and installs third-party agent skills during the lifecycle hook.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

`npm install -g @kyh/skills` runs the postinstall hook.

Impact

Package-controlled instructions and externally fetched skills become available to multiple AI coding agents across projects.

Mechanism

postinstall global AI-agent config injection and third-party skill installation

Policy narrative

On global installation, the postinstall script links package-supplied skills, agents, and global instructions into shared `~/.agents` and `~/.claude` locations used by multiple AI coding tools. It additionally runs a package-manager-backed skills installer against 14 external repositories with global scope. This is an unconsented lifecycle-hook mutation of a broad AI-agent control surface, even though it provides opt-outs and its current MCP list is empty.

Rationale

Source inspection confirms a concrete postinstall chain that injects package content into shared AI-agent directories and installs external skills globally. Under the install-control-surface policy, this requires blocking rather than treating the lifecycle hook as benign setup.

Evidence

package.jsonscripts/link.mjsexternal-skills.jsonmcp.jsonCLAUDE.mdagents/*.mdskills/*~/.agents/skills/*

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/link.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/link.mjsView file

7Install-time AI-agent control hijack evidence: L7: // 2. Non-universal agents (claude) get their own dirs symlinked to the canonical L8: // store: ~/.claude/skills/<name> -> ~/.agents/skills/<name>, etc. L9: // 3. CLAUDE.md -> ~/.claude/CLAUDE.md and mcp.json merged into ~/.claude.json. L10: // 4. External skill repos in external-skills.json are installed globally with ... L35: const AGENTS_DIR = path.join(HOME, ".agents"); // canonical store (read directly by universal agents) L36: const CLAUDE_DIR = path.join(HOME, ".claude"); // non-universal: symlinks into the canonical store L37: ... L69: await step(installExternalSkills); // npx skills add <repo> ... -> ~/.agents (parallel) L70: await step(linkClaude); // mirror everything in ~/.agents -> ~/.claude (incl. external) L71: a

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/link.mjsView on unpkg · L7

23L24: import { spawn, spawnSync } from "node:child_process"; L25: import fs from "node:fs";

High

Child Process

Package source references child process execution.

scripts/link.mjsView on unpkg · L23

10// 4. External skill repos in external-skills.json are installed globally with L11: // the bundled `skills` CLI (falls back to `npx skills`), all in parallel by L12: // default (throttle with KYH_SKILLS_CONCURRENCY; skip with ... L23: L24: import { spawn, spawnSync } from "node:child_process"; L25: import fs from "node:fs";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/link.mjsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = @kyh/skills@0.1.3 matchedPath = scripts/link.mjs matchedIdentity = npm:QGt5aC9za2lsbHM:0.1.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/link.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = ff7628bfcadc2a61 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kyh/skills@0.1.3 matchedPath = scripts/link.mjs matchedIdentity = npm:QGt5aC9za2lsbHM:0.1.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/link.mjsView on unpkg