@montytools/cli: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@montytools/cli: AI-agent control-surface risk | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/monty.mjsView file

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/monty.mjsView on unpkg · L5

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto"; ... L10: import { StringDecoder } from "node:string_decoder"; L11: import { createServer } from "node:http"; L12: import { connect as netConnect } from "node:net"; ... L28: // at ~/.monty-dev so platform development never touches the real state. L29: const CONFIG_DIR = process.env.MONTY_HOME L30: ? resolve(process.env.MONTY_HOME) L31: : join(homedir(), ".monty"); L32: const CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L104: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/monty.mjsView on unpkg · L5

243try { L244: spawn(cmd, args, { stdio: "ignore", detached: true }).unref(); L245: } catch { ... L253: // The build skill ships inside this package. Primary installer is the L254: // cross-agent standard `npx skills add` (same as InsForge) which fans out to L255: // every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L243

•matchType = normalized_sha256 matchedPackage = @montytools/cli@0.5.21 matchedPath = bin/monty.mjs matchedIdentity = npm:QG1vbnR5dG9vbHMvY2xp:0.5.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/monty.mjsView on unpkg

lib/styleLint.mjsView file

28]) { L29: if (existsSync(p)) return import(pathToFileURL(p).href); L30: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/styleLint.mjsView on unpkg · L28

bin/postinstall.mjsView file

1// Best-effort: put the agent build skill where Claude Code looks for it L2: // (~/.claude/skills) as soon as the package lands. Never fails the install; L3: // set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time. L4: import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L14: const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version; L15: const target = join(homedir(), ".claude", "skills"); L16: mkdirSync(target, { recursive: true }); L17: for (const name of readdirSync(src)) { L18: cpSync(join(src, name), join(target, name), { recursive: true }); L19: writeFileSync(join(target, name, "VERSION"), version + "\n"); L20: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join } from "node:path"; import { fileurltopath } from "node:url"; try { if (process.env.monty_no_skills || process.env.ci) process.exit(0); const root = join(dirname(fileurltopath(import.meta.url)), ".."); const src = join(root, "skills"); if (!existssync(src)) process.exit(0); const version = json.parse(readfilesync(join(root, "package.json"), "utf8")).version; const target = join(homedir(), ".claude", "skills"); mkdirsync(target, { recursive: true }); for (const name of readdirsync(src)) { cpsync(join(src,

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.mjs

Source & flagged code

9 flagged

package.jsonView file

Lines 6-37json

6 "url": "git+https://github.com/TomasMonty/monty-v2.git",

7 "directory": "packages/cli"

8 },

9 "type": "module",

10 "bin": {

11 "monty": "./bin/monty.mjs"

12 },

13 "files": [

14 "bin",

15 "lib",

16 "template",

17 "skills"

18 ],

19 "engines": {

20 "node": ">=22"

21 },

22 "scripts": {

23 "prepack": "node scripts/bundle-template.mjs",

24 "typecheck": "node --check bin/monty.mjs && node --check lib/compile.mjs && node --check lib/schemaCodegen.mjs && node --check lib/schemaPull.mjs && node --check lib/views.mjs && node --check scripts/schema-roundtrip.mjs && node --check lib/styleLint.mjs && node --check lib/sdkComponents.mjs && node --check lib/routes.mjs",

25 "test": "node --test \"test/*.test.mjs\"",

26 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "test:roundtrip": "node scripts/schema-roundtrip.mjs"

28 },

29 "dependencies": {

30 "esbuild": "^0.28.1",

31 "typescript": "6.0.3"

32 },

33 "publishConfig": {

34 "access": "public"

35 }

36}

37

bin/monty.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// monty — the Monty platform CLI. Output is agent-shaped: structured

3// single-line events, no spinners, instruction-shaped errors, and a

4// deterministic final line (`saved: …` / `error: …`).

5

6import { spawn, spawnSync } from "node:child_process";

7import { createHash, randomBytes } from "node:crypto";

lib/styleLint.mjsView file

Lines 8-48javascript

8//

9// Scope: agent-authored app code only — src/**/*.{ts,tsx,jsx} minus the

10// vendored kit (src/components/ui/**), generated files, and wiring. A line

11// carrying `monty-style-ignore` is skipped (the stylelint-disable of this

12// system; use it for the rare sanctioned exception, never to silence a page).

13import { existsSync, readFileSync, readdirSync } from "node:fs";

14import { dirname, join, relative } from "node:path"

bin/postinstall.mjsView file

Lines 1-21javascript

1// Best-effort: put the agent build skill where Claude Code looks for it

2// (~/.claude/skills) as soon as the package lands. Never fails the install;

3// set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time.

4import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from

Lines 223-263javascript

223

224 server.listen(0, "127.0.0.1", () => {

225 const { port } = server.address();

226 const authUrl = `${host}/cli-auth?redirect=${encodeURIComponent(

227 `http://127.0.0.1:${port}/callback`,

228 )}&state=${state}`;

229 console.log(`auth: opening ${host}/cli-auth in your browser (sign in, click Authorize)`);

230 console.log(`auth: if nothing opens, visit ${authUrl}`);

231 openInBrowser(authUrl);

232 });

233 });

234}

235

236function openInBrowser(url) {

237 const [cmd, args] =

238 process.platform === "darwin"

239 ? ["open", [url]]

240 : process.platform === "win32"

241 ? ["cmd", ["/c", "start", "", url]]

242 : ["xdg-open", [url]];

243 try {

244 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

245 } catch {

246 /* URL is already printed; paste flow remains available */

247 }

248}

249

250

251

252// ── agent skills ─────────────────────────────────────────────────────────────

253// The build skill ships inside this package. Primary installer is the

254// cross-agent standard `npx skills add` (same as InsForge) which fans out to

255// every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L243

256// Manual copy is the offline fallback. A version marker gates the work so

257// ordinary commands stay fast.

258const CLI_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");

259const CLI_VERSION = JSON.parse(readFileSync(join(CLI_ROOT, "package.json"), "utf8")).version;

260const SKILLS_SRC = join(CLI_ROOT, "skills");

261const GLOBAL_SKILLS_MARKER = join(CONFIG_DIR, "skills-version");

262// InsForge's agent list — enumerate rather than '*' so we only touch real agents.

263const SKILL_AGENTS = ["antigravity", "augment", "claude-code", "cline", "codex", "cursor", "gemini-cli", "github-copilot", "kilo", "qoder", "qwen-code", "roo", "trae", "windsurf"]