Loading npm security reports…

@lovrabet/rabetbase-cli@2.5.0: AI-agent control-surface risk | LPM Firewall

registry / @lovrabet/rabetbase-cli / 2.5.0

@lovrabet/rabetbase-cli@2.5.0

Developer CLI for Lovrabet apps, datasets, pages, SQL, Backend Function, database connections, skills, and AI agent workflows.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install runs a postinstall hook that non-interactively installs this package's rabetbase skill into global AI-agent skill directories. The installer uses npx -y skills@latest add <source> -g -y and then checks ~/.agents/skills and ~/.claude/skills.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall after the package is installed.

Impact

A user who only installs the CLI gets a skill written into broad agent control surfaces that Claude and other agents load from the home directory, without an install-time prompt.

Mechanism

scripts/postinstall.mjs loads lib/postinstall.js, which calls installBuiltinSkill. That spawns npx to add the package skill globally with confirmation flags forced on, then treats .agents/skills/rabetbase and .claude/skills/rabetbase under the user home as the install result.

Policy narrative

Installing the package runs postinstall, which loads lib/postinstall.js and calls installBuiltinSkill. That function starts npx with -y, skills@latest, add, the package skill source, -g, and -y, and it pipes stdio so the user is not asked. The skills CLI is expected to place rabetbase under the home directories .agents/skills and .claude/skills, which multiple AI agents load. The only bypass is setting RABETBASE_SKIP_NPX_SKILLS to 1. This is an unconsented install-time write to a broad agent control surface.

AI rationale

The postinstall path unconditionally launches a global skills install into home directories shared by AI agents, with the yes flags set and stdio piped. That is unconsented mutation of a broad agent control surface, even though the skill text is this CLI's own workflow.

Evidence

package.jsonscripts/postinstall.mjslib/postinstall.jslib/skills/builtin-skill.js

Source & flagged code

4 flagged

package.jsonView file

Lines 52-92json

52 "verify:release-package": "node scripts/verify-release-package.mjs",

53 "beta-release": "node scripts/beta-release.mjs",

54 "release": "node scripts/latest-release.mjs",

55 "test": "vitest run",

56 "test:run": "vitest run",

57 "test:coverage": "vitest run --coverage",

58 "test:ui": "vitest --ui",

59 "test:watch": "vitest --watch",

60 "test:unit": "vitest run test/unit",

61 "test:app": "vitest run test/unit/commands/app-shared.test.ts test/unit/commands/workspace-add.test.ts test/unit/commands/workspace-remove.test.ts test/unit/commands/app-list.test.ts test/unit/commands/workspace.test.ts test/unit/commands/app-workspace-migration.test.ts",

62 "test:integration": "vitest run test/integration",

63 "test:e2e": "vitest run test/e2e",

64 "test:e2e:daily": "RABETBASE_E2E_DAILY=1 vitest run test/e2e/daily-app-smoke.test.ts",

65 "test:windows": "node test/run-windows-tests.js",

66 "test:windows:unit": "node test/run-windows-tests.js unit",

67 "test:windows:integration": "node test/run-windows-tests.js integration",

68 "typecheck": "tsc --noEmit",

69 "publish:github": "node scripts/publish-github.mjs",

70 "generate:builtin-skill-manifest": "node scripts/generate-builtin-skill-manifest.mjs",

71 "check:builtin-skill-manifest": "node scripts/generate-builtin-skill-manifest.mjs --check",

72 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L72

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L72

73 "lint": "echo 'No linter configured yet'",

74 "check:skill-version": "node scripts/check-skill-version.mjs",

75 "check:lockfile": "node scripts/check-lockfile-integrity.mjs",

76 "ci": "npm run typecheck && npm run check:skill-version && npm run test:run && npm run build"

77 },

78 "publishConfig": {

79 "access": "public"

80 },

81 "files": [

82 "lib",

83 "skills/rabetbase",

84 "skills/rabetbase.manifest.json",

85 "scripts/postinstall.mjs",

86 "templates/generate-api",

87 "sidecar",

88 "README.md",

89 "LICENSE"

90 ],

91 "dependencies": {

92 "@inquirer/prompts": "^8.3.2",

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { existsSync } from "node:fs";

3import { dirname, join, resolve } from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

5

6const

lib/generated/build-info.jsView file

Lines 1-1javascript

1const a255_0x21ebc2=a255_0x13dc;function a255_0x5cbf(){const _0x1feb86=['11sLQNwz','706520vnyIlN','6633gGQwFu','a77966c','2.5.0','4aznJQD','9908040abOBKn',