registry / @lsproxy/cli / 1.1.1
@lsproxy/cli@1.1.1
Standalone refactor CLI driving any LSP server: project-wide rename, file-move with importer updates, and code actions.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe automatic install-time addition of a package-owned Claude Code skill is a guarded agent extension lifecycle risk under the review policy. The inspected code supports a warning, but not a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The package’s postinstall hook runs during installation.
Impact
Claude Code may load the added skill, changing the user’s agent capabilities after package installation.
Mechanism
The hook copies bundled skill directories under the user’s home directory into ~/.claude/skills.
AI rationale
The automatic install-time addition of a package-owned Claude Code skill is a guarded agent extension lifecycle risk under the review policy. The inspected code supports a warning, but not a publish block.
Evidence
package.jsonskillit-postinstall.cjsskills/lsproxy-cli/SKILL.md~/.claude/skills
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs skillit-postinstall.cjs as an automatic postinstall hook.
- The hook copies bundled skill directories into the user’s ~/.claude/skills directory during installation, with no consent check.
- The installed skill is named lsproxy-cli and describes this package’s refactoring CLI.
- The separate Claude Code settings adapter is reached through the explicit config export command; it only writes settings when it has matching installed plugins.
Evidence against
- The automatic hook installs this package’s own skill files; the inspected behavior does not show a remote payload or broad rewrite of Claude Code settings.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./sk[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg69"postinstall": "node ./sk[redacted]",
"skill:gen": "tsx scripts/gen-skill.ts"
}
}
Medium
Suspicious Lifecycle Evidence
package.json runs skillit-postinstall.cjs as an automatic postinstall hook.
package.jsonView on unpkg · L69skillit-postinstall.cjsView file
26const updated = content.replaceAll(npxPrefix, binName);
L27: if (updated !== content) fs.writeFileSync(full, updated, 'utf8');
L28: }
...
L32: function copyDir(src, dest) {
L33: fs.mkdirSync(dest, { recursive: true });
L34: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L39: } else {
L40: fs.copyFileSync(srcPath, destPath);
L41: }
...
L44:
L45: const userSkillsDir = path.join(os.homedir(), '.claude', 'skills');
L46: try {
Critical
Findings
1 Critical2 High5 Medium4 Low
CriticalAi Agent Control Hijackskillit-postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/connect.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceskillit-postinstall.cjs
MediumAi Review Evidenceskills/lsproxy-cli/SKILL.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lsproxy/cli@1.1.1.
See all versions of @lsproxy/cli for other recorded verdicts.
- Review the evidence and your use of @lsproxy/cli@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.