registry / AI-agent control-surface risk / @open_mind/editor-sdk
@open_mind/editor-sdk
Public integration SDK for connecting React and Next.js sites to the Fieldmatch visual editor.
This report shows the evidence for @open_mind/editor-sdk@0.2.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection confirms an automatic postinstall hook that writes a consumer project's AGENTS.md and agent-skill directory, as well as other project files. This meets the install-control-surface blocking policy despite no observed exfiltration or shell execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation invokes postinstall.
Impact
A package install can alter how compatible coding agents behave throughout the consumer project and also modify project configuration and routes.
Mechanism
Postinstall copies an agent skill and writes mandatory instructions into AGENTS.md.
Policy narrative
On installation, postinstall runs the installer in the consumer project. It copies a package-provided agent skill, creates or replaces a managed block in the root AGENTS.md, and instructs agents to use that skill for broad categories of visible site content. It also changes .env.local and may create a revalidation route. The automatic, project-wide AI-agent instruction mutation is unconsented and occurs before an explicit user setup command.
AI rationale
Direct inspection confirms an automatic postinstall hook that writes a consumer project's AGENTS.md and agent-skill directory, as well as other project files. This meets the install-control-surface blocking policy despite no observed exfiltration or shell execution.
Evidence
package.jsonscripts/install-agent-assets.mjs.agents/skills/fieldmatch-editable-componentsAGENTS.md.env.localFIELDMATCH_EDITOR.mdapp/api/revalidate/route.tssrc/app/api/revalidate/route.ts
Network endpoints2
fieldmatch-canvas-editor.vercel.appfieldmatch-canvas-cms.vercel.app
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs its asset installer automatically through postinstall.
- The installer copies a skill into the consumer project's agent-skill directory.
- The installer creates or rewrites the consumer project's root AGENTS.md with mandatory instructions.
- The same install hook modifies environment configuration and can add a Next.js route.
Evidence against
- The inspected installer contains no network requests, shell execution, or secret exfiltration.
- The runtime SDK uses a caller-configured CMS endpoint and only sends a preview token when supplied by the caller.
Behavioral surface
CryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/install-agent-assets.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/install-agent-assets.mjsView file
15L16: **Mandatory:** before creating or changing any visitor-visible text, link, image, or video, read and use the \`$fieldmatch-editable-components\` skill installed at \`.agents/skills...
L17:
...
L63: }
L64: await mkdir(dirname(routeTarget), { recursive: true })
L65: await cp(resolve(packageRoot, 'templates/next-revalidate-route.ts'), routeTarget)
L66: return 'created'
...
L76:
L77: const skillTarget = resolve(targetRoot, '.agents/skills/fieldmatch-editable-components')
L78: await mkdir(dirname(skillTarget), { recursive: true })
L79: await cp(resolve(packageRoot, 'skills/fieldmatch-editable-components'), skillTarget, {
L80: recursive: true,
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-agent-assets.mjsView on unpkg · L15Findings
1 Critical3 High3 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agent-assets.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/install-agent-assets.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install-agent-assets.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @open_mind/editor-sdk@0.2.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @open_mind/editor-sdk@0.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.