Loading npm security reports…

@nerdev/skillset@0.2.3: AI-agent control-surface risk | LPM Firewall

registry / @nerdev/skillset / 0.2.3

@nerdev/skillset@0.2.3

A curated, auto-synced collection of agent skills (design, animation, dev workflow) with a CLI to install them into any harness: Claude Code, OpenCode, Cursor, Codex, Gemini.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically writes packaged agent skills into broad, foreign AI-agent control surfaces. No user CLI command, target selection, or scope selection is required.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes the package install lifecycle.

Impact

It can alter the behavior and available capabilities of several AI-agent environments on the host.

Mechanism

The lifecycle calls the installer, which defaults to all harnesses and global scope, then creates directories and copies skills.

Policy narrative

During npm installation, the declared install lifecycle runs the package CLI with the install command. That command uses global scope by default, chooses every configured agent harness when no target is supplied, and copies packaged skills into their control directories. This is an unconsented install-time mutation of broad third-party AI-agent control surfaces.

AI rationale

The automatic npm lifecycle performs broad AI-agent configuration mutation without an explicit user command or target selection. This meets the install-control-surface blocking rule even though no credential theft or fixed external endpoint was identified.

Evidence

package.jsonbin/skillset.mjs.claude/skills.config/opencode/skills.cursor/skills.agents/skills.gemini/skills

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.install = node bin/skillset.mjs install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = node bin/skillset.mjs install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/ui/impeccable/scripts/live-browser.jsView file

5280const url = bust ? candidate + (candidate.includes('?') ? '&' : '?') + 't=' + Date.now() : candidate; L5281: const mod = await import(/* @vite-ignore */ url); L5282: return { mod, url: candidate };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

skills/ui/impeccable/scripts/live-browser.jsView on unpkg · L5280

bin/skillset.mjsView file

13import { execSync } from "node:child_process"; L14: import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs"; L15: import { homedir } from "node:os"; ... L22: const HARNESSES = { L23: claude: { global: join(homedir(), ".claude", "skills"), project: ".claude/skills" }, L24: opencode: { global: join(homedir(), ".config", "opencode", "skills"), project: ".opencode/skills" }, L25: cursor: { global: join(homedir(), ".cursor", "skills"), project: ".cursor/skills" }, L26: codex: { global: join(homedir(), ".agents", "skills"), project: ".agents/skills" }, L27: gemini: { global: join(homedir(), ".gemini", "skills"), project: ".gemini/skills" }, ... L150: } L151: mkdirSync(destBase, { recursive: true }); L152: cpSync(join(SKILLS_DIR, skill), dest, { recursive:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/skillset.mjsView on unpkg · L13

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { execsync } from "node:child_process"; import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, rmsync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/skillset.mjs

scripts/ste-lint.pyView file

•path = scripts/ste-lint.py kind = build_helper sizeBytes = 9763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ste-lint.pyView on unpkg

skills/ui/impeccable/scripts/modern-screenshot.umd.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/ui/impeccable/scripts/modern-screenshot.umd.js#virtual:normalized:round1View on unpkg