Loading npm security reports…

@montytools/cli@0.5.6: AI-agent control-surface risk | LPM Firewall

registry / @montytools/cli / 0.5.6

@montytools/cli@0.5.6

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes global Claude Code and Codex instruction surfaces. The Codex change inserts package-controlled agent instructions into an existing user configuration file.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the declared postinstall hook.

Impact

A package installation can alter future AI-agent behavior outside the installed project without an explicit setup command.

Mechanism

Automatic copying of agent skills and replacement or insertion of a managed AGENTS.md block.

Policy narrative

The npm postinstall hook runs automatically and copies package-provided skills to the user's Claude Code directory. If Codex is present, it writes a versioned package-controlled block into the user's global AGENTS.md, replacing an earlier block when found. Those instructions steer agents toward this package's CLI and cloud-save workflow. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The package performs automatic postinstall writes to global Claude Code and Codex instruction locations, including replacement of a managed AGENTS.md block. This meets the install-control-surface policy for malicious install-hook abuse despite no confirmed credential exfiltration.

Evidence

package.jsonbin/postinstall.mjsskills/monty-build/SKILL.md~/.claude/skills~/.codex/AGENTS.md

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/monty.mjsView file

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/monty.mjsView on unpkg · L5

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/monty.mjs: import { appendFileSync, closeSync, cpSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, symlinkSync, writeFileSync, readdirSync, statSync, existsSync } from "n... const DEFAULT_HOST = "https://usemonty.dev"; writeFileSync( writeFileSync( writeFileSync(GLOBAL_SKILLS_MARKER, CLI_VERSION + "\n"); writeFileSync(marker, CLI_VERSION + "\n"); writeFileSync(join(dir, ".monty", "app.json"), JSON.stringify(next, null, 2) + "\n"); // Pack the app's source tree (node_modules/dist/.monty/.git excluded) into a

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/monty.mjsView on unpkg

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto"; ... L10: import { StringDecoder } from "node:string_decoder"; L11: import { createServer } from "node:http"; L12: import { connect as netConnect } from "node:net"; ... L25: // at ~/.monty-dev so platform development never touches the real state. L26: const CONFIG_DIR = process.env.MONTY_HOME L27: ? resolve(process.env.MONTY_HOME) L28: : join(homedir(), ".monty"); L29: const CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L101: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/monty.mjsView on unpkg · L5

240try { L241: spawn(cmd, args, { stdio: "ignore", detached: true }).unref(); L242: } catch { ... L250: // The build skill ships inside this package. Primary installer is the L251: // cross-agent standard `npx skills add` (same as InsForge) which fans out to L252: // every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L240

lib/styleLint.mjsView file

28]) { L29: if (existsSync(p)) return import(pathToFileURL(p).href); L30: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/styleLint.mjsView on unpkg · L28

bin/postinstall.mjsView file

1// Best-effort: put the agent build skill where Claude Code looks for it L2: // (~/.claude/skills) as soon as the package lands. Never fails the install; L3: // set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time. L4: import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L14: const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version; L15: const target = join(homedir(), ".claude", "skills"); L16: mkdirSync(target, { recursive: true }); L17: for (const name of readdirSync(src)) { L18: cpSync(join(src, name), join(target, name), { recursive: true }); L19: writeFileSync(join(target, name, "VERSION"), version + "\n"); L20: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join } from "node:path"; import { fileurltopath } from "node:url"; try { if (process.env.monty_no_skills || process.env.ci) process.exit(0); const root = join(dirname(fileurltopath(import.meta.url)), ".."); const src = join(root, "skills"); if (!existssync(src)) process.exit(0); const version = json.parse(readfilesync(join(root, "package.json"), "utf8")).version; const target = join(homedir(), ".claude", "skills"); mkdirsync(target, { recursive: true }); for (const name of readdirsync(src)) { cpsync(join(src,

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.mjs

Source & flagged code

9 flagged

package.jsonView file

Lines 6-36json

6 "url": "git+https://github.com/TomasMonty/monty-v2.git",

7 "directory": "packages/cli"

8 },

9 "type": "module",

10 "bin": {

11 "monty": "./bin/monty.mjs"

12 },

13 "files": [

14 "bin",

15 "lib",

16 "template",

17 "skills"

18 ],

19 "engines": {

20 "node": ">=22"

21 },

22 "scripts": {

23 "prepack": "node scripts/bundle-template.mjs",

24 "typecheck": "node --check bin/monty.mjs && node --check lib/compile.mjs && node --check lib/schemaCodegen.mjs && node --check lib/schemaPull.mjs && node --check lib/views.mjs && node --check scripts/schema-roundtrip.mjs && node --check lib/styleLint.mjs",

25 "test": "node --test \"test/*.test.mjs\"",

26 "postinstall": "node bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "test:roundtrip": "node scripts/schema-roundtrip.mjs"

28 },

29 "dependencies": {

30 "esbuild": "^0.28.1"

31 },

32 "publishConfig": {

33 "access": "public"

34 }

35}

36

bin/monty.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// monty — the Monty platform CLI. Output is agent-shaped: structured

3// single-line events, no spinners, instruction-shaped errors, and a

4// deterministic final line (`saved: …` / `error: …`).

5

6import { spawn, spawnSync } from "node:child_process";

7import { createHash, randomBytes } from "node:crypto";

lib/styleLint.mjsView file

Lines 8-48javascript

8//

9// Scope: agent-authored app code only — src/**/*.{ts,tsx,jsx} minus the

10// vendored kit (src/components/ui/**), generated files, and wiring. A line

11// carrying `monty-style-ignore` is skipped (the stylelint-disable of this

12// system; use it for the rare sanctioned exception, never to silence a page).

13import { existsSync, readFileSync, readdirSync } from "node:fs";

14import { dirname, join, relative } from "node:path"

bin/postinstall.mjsView file

Lines 1-21javascript

1// Best-effort: put the agent build skill where Claude Code looks for it

2// (~/.claude/skills) as soon as the package lands. Never fails the install;

3// set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time.

4import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from

Lines 220-260javascript

220

221 server.listen(0, "127.0.0.1", () => {

222 const { port } = server.address();

223 const authUrl = `${host}/cli-auth?redirect=${encodeURIComponent(

224 `http://127.0.0.1:${port}/callback`,

225 )}&state=${state}`;

226 console.log(`auth: opening ${host}/cli-auth in your browser (sign in, click Authorize)`);

227 console.log(`auth: if nothing opens, visit ${authUrl}`);

228 openInBrowser(authUrl);

229 });

230 });

231}

232

233function openInBrowser(url) {

234 const [cmd, args] =

235 process.platform === "darwin"

236 ? ["open", [url]]

237 : process.platform === "win32"

238 ? ["cmd", ["/c", "start", "", url]]

239 : ["xdg-open", [url]];

240 try {

241 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

242 } catch {

243 /* URL is already printed; paste flow remains available */

244 }

245}

246

247

248

249// ── agent skills ─────────────────────────────────────────────────────────────

250// The build skill ships inside this package. Primary installer is the

251// cross-agent standard `npx skills add` (same as InsForge) which fans out to

252// every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L240

253// Manual copy is the offline fallback. A version marker gates the work so

254// ordinary commands stay fast.

255const CLI_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");

256const CLI_VERSION = JSON.parse(readFileSync(join(CLI_ROOT, "package.json"), "utf8")).version;

257const SKILLS_SRC = join(CLI_ROOT, "skills");

258const GLOBAL_SKILLS_MARKER = join(CONFIG_DIR, "skills-version");

259// InsForge's agent list — enumerate rather than '*' so we only touch real agents.

260const SKILL_AGENTS = ["antigravity", "augment", "claude-code", "cline", "codex", "cursor", "gemini-cli", "github-copilot", "kilo", "qoder", "qwen-code", "roo", "trae", "windsurf"]