registry / AI-agent control-surface risk / @ojesusmp/model-effort-router

@ojesusmp/model-effort-router

Claude Code skill that routes every delegated task to the cheapest model tier that can do it well, escalates only on evidence, and adapts automatically when models are added, renamed, or removed.

This report shows the evidence for @ojesusmp/model-effort-router@1.3.0. 1 of 2 known versions is blocked or flagged. The newest version, 1.4.1, is flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Source inspection confirms unconsented lifecycle writes to Claude Code skill directories, which is a concrete AI-agent control-surface mutation even though the content matches the package theme and has no network exfiltration. Under the firewall boundary, this warrants blocking as ai_agent_control_hijack. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or any package manager lifecycle execution

Impact

Changes future Claude Code skill behavior/model routing and installs a companion hardening skill

Mechanism

postinstall AI skill file drop

Policy narrative

On installation, npm runs bin/install.mjs. The script derives ~/.claude/skills and copies package-supplied Claude Code skill instructions into model-effort-router and skill-hardener directories, causing later Claude Code sessions to load package-controlled agent routing/hardening instructions. I found no exfiltration or destructive payload, but the install-time mutation of an AI-agent control surface is concrete.

AI rationale

Evidence

package.jsonbin/install.mjsSKILL.mdskills/skill-hardener/SKILL.md~/.claude/skills/model-effort-router/SKILL.md~/.claude/skills/model-effort-router/README.md~/.claude/skills/model-effort-router/LICENSE~/.claude/skills/model-effort-router/CHANGELOG.md~/.claude/skills/skill-hardener/SKILL.md~/.claude/skills/skill-hardener/README.md~/.claude/skills/skill-hardener/test/hardener-quiz.txt

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 88.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall: node bin/install.mjs
bin/install.mjs writes package SKILL.md/README/LICENSE/CHANGELOG into ~/.claude/skills/model-effort-router
bin/install.mjs also writes bundled skills/skill-hardener files into ~/.claude/skills/skill-hardener
Installed SKILL.md governs Claude Code delegation/model selection and subagent prompts

Evidence against

No network calls or exfiltration endpoints found
No child_process, eval, dynamic code loading, persistence daemon, or destructive file operations found
Install script is best-effort and skips CI or MER_SKIP_POSTINSTALL
Behavior is aligned with the package's stated Claude skill purpose

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.94 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 31-62json

31 ],

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/ojesusmp/model-effort-router.git"

35 },

36 "type": "module",

37 "files": [

38 "SKILL.md",

39 "README.md",

40 "LICENSE",

41 "CHANGELOG.md",

42 "test/",

43 "tools/",

44 "skills/",

45 "bin/install.mjs"

46 ],

47 "bin": {

48 "model-effort-router-install": "bin/install.mjs"

49 },

50 "scripts": {

51 "postinstall": "node bin/install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 "test": "node bin/install.mjs --dry-run",

53 "validate": "node .github/scripts/validate.mjs"

54 },

55 "engines": {

56 "node": ">=18"

57 },

58 "publishConfig": {

59 "access": "public"

60 }

61}

bin/install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Postinstall: copy model-effort-router skill files into the user's Claude Code skills dir.

3// Cross-platform (Windows / macOS / Linux). Idempotent. Safe to re-run.

4// Skip in CI and skip when running inside the source repo itself.

6import { existsSync, mkdirSync, copyFileSync } from "node:fs";

7import { homedir, platform } from "node:os";

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install.mjsView file

1Install-time AI-agent control hijack evidence: L5: L6: import { existsSync, mkdirSync, copyFileSync } from "node:fs"; L7: import { homedir, platform } from "node:os"; ... L35: L36: const skillsRoot = join(homedir(), ".claude", "skills"); L37: const targetRoot = join(skillsRoot, "model-effort-router"); ... L50: } L51: mkdirSync(dirname(d), { recursive: true }); L52: copyFileSync(s, d); L53: } ... L61: if (!DRY_RUN && !existsSync(targetRoot)) { L62: mkdirSync(targetRoot, { recursive: true }); Payload evidence from skills/sk[redacted]/SKILL.md: L1: --- L2: name: sk[redacted]

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/install.mjsView on unpkg · L1

Findings

1 Critical1 High3 Medium3 Low

CriticalAi Agent Control Hijackbin/install.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @ojesusmp/model-effort-router@1.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @ojesusmp/model-effort-router@1.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-03 01:06:43.726Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.4.1latestSuspiciousAgent extension lifecycle riskWarnPublishedJul 15, 2026, 5:06 PM 1.3.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 3, 2026, 1:05 AM

88%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

AuthorOrlando Molina

Version1.3.0

PublishedJul 3, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size33.2 KB

Files11

Keywordsclaudeclaude-codeclaude-skillskillmodel-routingdelegationsubagentscost-optimization

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → model-effort-router-install

Runtimenode >=18

Artifact98.7 KB · 11 files1 signature(s) · provenance

Install lifecyclepostinstall

Behavioral surface

EnvironmentVarsFilesystemHighEntropyStringsManifest: clean

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Source & flagged code

Related packages

Other AI-agent control-surface risk packages