registry / @lsproxy/cli / 1.0.3
@lsproxy/cli@1.0.3
Standalone refactor CLI driving any LSP server: project-wide rename, file-move with importer updates, and code actions.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe automatic install-time addition of a package-owned Claude Code skill warrants a warning under the agent extension lifecycle policy. The reviewed source describes refactoring functionality and does not establish a concrete attack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The package's npm postinstall hook runs.
Impact
Claude Code can discover and use the installed package-owned skill after installation.
Mechanism
The hook copies each bundled skill directory under the user's Claude Code skills directory.
AI rationale
The automatic install-time addition of a package-owned Claude Code skill warrants a warning under the agent extension lifecycle policy. The reviewed source describes refactoring functionality and does not establish a concrete attack chain.
Evidence
package.jsonskillit-postinstall.cjsskills/lsproxy-cli/SKILL.mdskills/lsproxy-cli/~/.claude/skills/lsproxy-cli/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that copies its bundled skills into the user's Claude Code skills directory.
- The bundled skill describes an LSP refactoring CLI.
- Claude Code plugin settings are changed through the separate `config export` command, which enables matching installed plugins.
Evidence against
- The inspected install hook performs a local skill copy; the bundled skill describes refactoring functionality.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./sk[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg69"postinstall": "node ./sk[redacted]",
"skill:gen": "t
Medium
Suspicious Lifecycle Evidence
The package runs a postinstall script that copies its bundled skills into the user's Claude Code skills directory.
package.jsonView on unpkg · L69skillit-postinstall.cjsView file
26const updated = content.replaceAll(npxPrefix, binName);
L27: if (updated !== content) fs.writeFileSync(full, updated, 'utf8');
L28: }
...
L32: function copyDir(src, dest) {
L33: fs.mkdirSync(dest, { recursive: true });
L34: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L39: } else {
L40: fs.copyFileSync(srcPath, destPath);
L41: }
...
L44:
L45: const userSkillsDir = path.join(os.homedir(), '.claude', 'skills');
L46: try {
Critical
Findings
1 Critical1 High7 Medium3 Low
CriticalAi Agent Control Hijackskillit-postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidenceskillit-postinstall.cjs
MediumSuspicious Lifecycle Evidenceskillit-postinstall.cjs
MediumSuspicious Lifecycle Evidenceskillit-postinstall.cjs
MediumAi Review Evidenceskills/lsproxy-cli/SKILL.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @lsproxy/cli@1.0.3.
See all versions of @lsproxy/cli for other recorded verdicts.
- Review the evidence and your use of @lsproxy/cli@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.