@montytools/cli@0.5.12: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@montytools/cli@0.5.12: AI-agent control-surface risk | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/monty.mjsView file

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/monty.mjsView on unpkg · L5

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto"; ... L10: import { StringDecoder } from "node:string_decoder"; L11: import { createServer } from "node:http"; L12: import { connect as netConnect } from "node:net"; ... L26: // at ~/.monty-dev so platform development never touches the real state. L27: const CONFIG_DIR = process.env.MONTY_HOME L28: ? resolve(process.env.MONTY_HOME) L29: : join(homedir(), ".monty"); L30: const CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L102: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/monty.mjsView on unpkg · L5

241try { L242: spawn(cmd, args, { stdio: "ignore", detached: true }).unref(); L243: } catch { ... L251: // The build skill ships inside this package. Primary installer is the L252: // cross-agent standard `npx skills add` (same as InsForge) which fans out to L253: // every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L241

lib/styleLint.mjsView file

28]) { L29: if (existsSync(p)) return import(pathToFileURL(p).href); L30: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/styleLint.mjsView on unpkg · L28

bin/postinstall.mjsView file

1// Best-effort: put the agent build skill where Claude Code looks for it L2: // (~/.claude/skills) as soon as the package lands. Never fails the install; L3: // set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time. L4: import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L14: const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version; L15: const target = join(homedir(), ".claude", "skills"); L16: mkdirSync(target, { recursive: true }); L17: for (const name of readdirSync(src)) { L18: cpSync(join(src, name), join(target, name), { recursive: true }); L19: writeFileSync(join(target, name, "VERSION"), version + "\n"); L20: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join } from "node:path"; import { fileurltopath } from "node:url"; try { if (process.env.monty_no_skills || process.env.ci) process.exit(0); const root = join(dirname(fileurltopath(import.meta.url)), ".."); const src = join(root, "skills"); if (!existssync(src)) process.exit(0); const version = json.parse(readfilesync(join(root, "package.json"), "utf8")).version; const target = join(homedir(), ".claude", "skills"); mkdirsync(target, { recursive: true }); for (const name of readdirsync(src)) { cpsync(join(src,

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.mjs

Source & flagged code

8 flagged

package.jsonView file

Lines 6-36json

6 "url": "git+https://github.com/TomasMonty/monty-v2.git",

7 "directory": "packages/cli"

8 },

9 "type": "module",

10 "bin": {

11 "monty": "./bin/monty.mjs"

12 },

13 "files": [

14 "bin",

15 "lib",

16 "template",

17 "skills"

18 ],

19 "engines": {

20 "node": ">=22"

21 },

22 "scripts": {

23 "prepack": "node scripts/bundle-template.mjs",

24 "typecheck": "node --check bin/monty.mjs && node --check lib/compile.mjs && node --check lib/schemaCodegen.mjs && node --check lib/schemaPull.mjs && node --check lib/views.mjs && node --check scripts/schema-roundtrip.mjs && node --check lib/styleLint.mjs && node --check lib/sdkComponents.mjs",

25 "test": "node --test \"test/*.test.mjs\"",

26 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "test:roundtrip": "node scripts/schema-roundtrip.mjs"

28 },

29 "dependencies": {

30 "esbuild": "^0.28.1"

31 },

32 "publishConfig": {

33 "access": "public"

34 }

35}

36

bin/monty.mjsView file

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/monty.mjsView on unpkg · L5

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto"; ... L10: import { StringDecoder } from "node:string_decoder"; L11: import { createServer } from "node:http"; L12: import { connect as netConnect } from "node:net"; ... L26: // at ~/.monty-dev so platform development never touches the real state. L27: const CONFIG_DIR = process.env.MONTY_HOME L28: ? resolve(process.env.MONTY_HOME) L29: : join(homedir(), ".monty"); L30: const CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L102: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/monty.mjsView on unpkg · L5

241try { L242: spawn(cmd, args, { stdio: "ignore", detached: true }).unref(); L243: } catch { ... L251: // The build skill ships inside this package. Primary installer is the L252: // cross-agent standard `npx skills add` (same as InsForge) which fans out to L253: // every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L241

lib/styleLint.mjsView file

Lines 8-48javascript

8//

9// Scope: agent-authored app code only — src/**/*.{ts,tsx,jsx} minus the

10// vendored kit (src/components/ui/**), generated files, and wiring. A line

11// carrying `monty-style-ignore` is skipped (the stylelint-disable of this

12// system; use it for the rare sanctioned exception, never to silence a page).

13import { existsSync, readFileSync, readdirSync } from "node:fs";

14import { dirname, join, relative } from "node:path"

bin/postinstall.mjsView file

Lines 1-21javascript

1// Best-effort: put the agent build skill where Claude Code looks for it

2// (~/.claude/skills) as soon as the package lands. Never fails the install;

3// set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time.

4import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from