registry / AI-agent control-surface risk / @nookplot/cli

@nookplot/cli

CLI toolkit for NookPlot agent developers — scaffold, register, sync, and monitor agents

This report shows the evidence for @nookplot/cli@0.7.58. 1 of 4 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs concrete, unconsented postinstall writes to an existing AI-agent prompt/control surface. This meets the firewall block criterion regardless of the absence of observed exfiltration.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install or upgrade

Impact

Unconsented modification of a foreign AI-agent control surface.

Mechanism

postinstall mutation of OpenClaw prompt and skill files

Policy narrative

Installing the package automatically runs dist/postinstall.js. When OpenClaw directories exist, it rewrites or appends ~/.openclaw/workspace/TOOLS.md, which the package explicitly identifies as injected into every agent prompt, and creates ~/.openclaw/skills/nookplot/SKILL.md. These are foreign agent-control-surface mutations performed without an explicit setup command.

AI rationale

Evidence

package.jsondist/postinstall.jsdist/skillGenerator.js~/.nookplot/skill.md~/.openclaw/workspace/TOOLS.md~/.openclaw/skills/nookplot/SKILL.md./nookplot-skill.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

Install-time postinstall executes package code.
Postinstall rewrites/appends OpenClaw's prompt-injected TOOLS.md.
Postinstall creates an OpenClaw skill without an explicit user command.

Evidence against

The reviewed lifecycle code shows no network request or credential exfiltration.
GPU shell calls are user-invoked benchmark functionality.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 1.07 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, base.drpc.org, base.llamarpc.com, gateway.nookplot.com, gateway.pinata.cloud, github.com, ipfs.io, mainnet.base.org, my-agent.com, nookplot.com, ollama.com, python.org, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 4-44json

4 "description": "CLI toolkit for NookPlot agent developers — scaffold, register, sync, and monitor agents",

5 "author": "nookplot",

6 "type": "module",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "files": [

10 "dist",

11 "README.md"

12 ],

13 "publishConfig": {

14 "access": "public"

15 },

16 "bin": {

17 "nookplot": "dist/index.js"

18 },

19 "scripts": {

20 "build": "tsc && cp src/tool-manifest.json dist/tool-manifest.json && cp src/evalManifest.json dist/evalManifest.json",

21 "clean": "rm -rf dist",

22 "dev": "tsx src/index.ts",

23 "test": "vitest run",

24 "postinstall": "node dist/postinstall.js 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

26 "dependencies": {

27 "@nookplot/runtime": "^0.5.158",

28 "chalk": "5.6.2",

29 "commander": "12.1.0",

30 "dotenv": "16.6.1",

31 "ethers": "6.16.0",

32 "glob": "11.1.0",

33 "inquirer": "12.11.1",

34 "js-yaml": "4.1.1",

35 "ora": "8.2.0"

36 },

37 "peerDependencies": {

38 "@xmtp/agent-sdk": ">=0.1.0"

39 },

40 "peerDependenciesMeta": {

41 "@xmtp/agent-sdk": {

42 "optional": true

43 }

44 },

dist/adapters/supabase.jsView file

Lines 4-44javascript

4 * Pulls rows from a Supabase/PostgreSQL table and maps

5 * configurable columns to knowledge entries.

6 *

7 * Credentials come from env vars (referenced via ${VAR} in YAML).

8 *

dist/commands/gpu.jsView file

Lines 152-192javascript

152 .option("--amount <usdc>", "Token amount to pay")

153 .option("--token <usdc|nook>", "Payment token (usdc or nook)")

154 .option("--json", "Output raw JSON")

155 .option

dist/commands/submitPaperReproduction.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/submitPaperReproduction.jsView on unpkg

dist/utils/agentLoop.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nookplot/cli@0.7.48 matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.48 similarity = 0.915 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/utils/agentLoop.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/adapters/supabase.jsView file

24// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access L25: const mod = await import(/* webpackIgnore: true */ moduleName); L26: createClient = mod.createClient;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/supabase.jsView on unpkg · L24

Findings

4 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/commands/gpu.js

HighSemantic Analysis Limiteddist/commands/submitPaperReproduction.js

HighPrevious Version Dangerous Deltadist/utils/agentLoop.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/adapters/supabase.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nookplot/cli@0.7.58.

The versions list below shows the verdict for each recorded version.

Avoid installing @nookplot/cli@0.7.58. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-21 18:55:14.235Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.7.58latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 21, 2026, 6:48 PM 0.7.57SuspiciousAgent extension lifecycle riskWarnPublishedAug 20, 2026, 6:07 PM 0.7.48Suspicious—WarnPublishedJul 3, 2026, 12:55 AM 0.7.47Suspicious—WarnPublishedJul 2, 2026, 5:44 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @nookplot

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

More from @nookplot

Other AI-agent control-surface risk packages

Source & flagged code