registry / @lsproxy/cli / 1.1.2
@lsproxy/cli@1.1.2
Standalone refactor CLI driving any LSP server: project-wide rename, file-move with importer updates, and code actions.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe automatic postinstall writes a package-owned skill into Claude Code's user-level skill directory without consent. This fits the warning category for first-party agent extension setup; the inspected source does not establish a publish-blocking attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The package's postinstall lifecycle hook runs during installation.
Impact
The installed skill can affect later Claude Code sessions, and copying may replace files with matching names.
Mechanism
The hook creates ~/.claude/skills, then copies each packaged skill directory and its files there.
AI rationale
The automatic postinstall writes a package-owned skill into Claude Code's user-level skill directory without consent. This fits the warning category for first-party agent extension setup; the inspected source does not establish a publish-blocking attack.
Evidence
package.jsonskillit-postinstall.cjsskills/lsproxy-cli/SKILL.md~/.claude/skills/lsproxy-cli
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook runs skillit-postinstall.cjs automatically.
- That hook copies the package's skill files into the user's ~/.claude/skills directory without checking for consent.
- The copied skill describes the package's LSP refactoring CLI.
- The Claude Code adapter is also available through an explicit config export command.
Evidence against
- The inspected skill content describes CLI use; targeted searches found no reviewer-directed instructions, credential references, or shell download commands.
- The separate Claude Code settings adapter is called by the explicit config export flow.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./sk[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg69"postinstall": "node ./sk[redacted]",
"skill:gen": "tsx scripts/gen-skill.ts"
}
}
Medium
Suspicious Lifecycle Evidence
The package postinstall hook runs skillit-postinstall.cjs automatically.
package.jsonView on unpkg · L69skillit-postinstall.cjsView file
26const updated = content.replaceAll(npxPrefix, binName);
L27: if (updated !== content) fs.writeFileSync(full, updated, 'utf8');
L28: }
...
L32: function copyDir(src, dest) {
L33: fs.mkdirSync(dest, { recursive: true });
L34: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L39: } else {
L40: fs.copyFileSync(srcPath, destPath);
L41: }
...
L44:
L45: const userSkillsDir = path.join(os.homedir(), '.claude', 'skills');
L46: try {
Critical
Findings
1 Critical2 High5 Medium4 Low
CriticalAi Agent Control Hijackskillit-postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/connect.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceskillit-postinstall.cjs
MediumAi Review Evidenceskillit-postinstall.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lsproxy/cli@1.1.2.
See all versions of @lsproxy/cli for other recorded verdicts.
- Review the evidence and your use of @lsproxy/cli@1.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.