Loading npm security reports…

@optima-chat/dev-skills@0.16.11: AI-agent control-surface risk | LPM Firewall

registry / @optima-chat/dev-skills / 0.16.11

@optima-chat/dev-skills@0.16.11

Claude Code Skills for Optima development team - cross-environment collaboration tools

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook changes global Claude and Codex agent control surfaces without a separate user command. No network exfiltration was identified in the installer.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the npm package runs postinstall automatically.

Impact

Package-controlled instructions become available to the user's AI-agent environments and can overwrite same-named installed files.

Mechanism

The install script creates global agent directories and copies all packaged Claude commands and skills plus Codex skills into them.

Policy narrative

A normal npm installation invokes scripts/install.js. That script writes package-provided command and skill content into the user's global Claude directories and package-provided skills into the Codex skills directory. This is an unconsented install-time mutation of broad AI-agent control surfaces, so the package can alter future agent behavior independently of the project where it was installed.

AI rationale

The automatic postinstall hook performs broad global AI-agent configuration writes. This meets the install-control-surface blocking condition even though the installer itself contains no observed network send.

Evidence

package.jsonscripts/install.js~/.claude/commands~/.claude/skills$CODEX_HOME/skills/optima-dev

Decision evidence

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/helpers/query-db.tsView file

2L3: import { execSync } from 'child_process'; L4: import { sanitizeExecError } from './safe-exec'; ... L98: // 1. 优先从 PATH 中查找 L99: const whichCmd = process.platform === 'win32' ? 'where psql' : 'which psql'; L100: try { ... L134: : process.platform === 'win32' L135: ? 'Download from https://www.postgresql.org/download/windows/' L136: : 'sudo apt install postgresql-client'; ... L147: encoding: 'utf-8', L148: env: { ...process.env, PGPASSWORD: password } L149: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers/query-db.tsView on unpkg · L2

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/helpers/query-db.tsView on unpkg · L17

22patternName = generic_password severity = medium line = 22

Medium

Secret Pattern

Hardcoded password in bin/helpers/query-db.ts

bin/helpers/query-db.tsView on unpkg · L22

27patternName = generic_password severity = medium line = 27

Medium

Secret Pattern

Hardcoded password in bin/helpers/query-db.ts

bin/helpers/query-db.tsView on unpkg · L27

bin/helpers/cn-deploy.tsView file

34*/ L35: import { execFileSync } from 'node:child_process'; L36:

High

Child Process

Package source references child process execution.

bin/helpers/cn-deploy.tsView on unpkg · L34

bin/helpers/db-utils.tsView file

246export function getInfisicalToken(config: InfisicalConfig): string { L247: // 复用 curlJson（execFileSync + 参数数组、不经 shell）：Windows cmd.exe 不认单引号， L248: // 原来 shell 拼的 `-d '{...}'` JSON body 会被拆碎、curl 收垃圾参数直接退出（#92）。

High

Shell

Package source references shell execution.

bin/helpers/db-utils.tsView on unpkg · L246

bin/helpers/logs.ts#virtual:normalized:round1View file

119function stripQuoted(q: string): string { L120: return q.replace(/"(?:[^"\\]|\\.)*"/g, ' ');\n}\n\n/**\n * 带分析语句(SQL)的 query 用 `|` 分隔检索与分析两段。SLS 明确规定此时\n * line/offset 失效、要用 SQL 自己的 LIMIT 翻页 —— 这种 query 不能按页累加。\n *\n * 只看有没有 `|`... L121: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/helpers/logs.ts#virtual:normalized:round1View on unpkg · L119

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/helpers/logs.ts#virtual:normalized:round1View on unpkg

scripts/install.jsView file

6L7: const CLAUDE_DIR = path.join(os.homedir(), '.claude'); L8: const SKILLS_SOURCE = path.join(__dirname, '..', '.claude'); L9: const CODEX_DIR = process.env.CODEX_HOME L10: ? path.resolve(process.env.CODEX_HOME) L11: : path.join(os.homedir(), '.codex'); L12: const CODEX_SOURCE = path.join(__dirname, '..', '.codex'); L13: const COMMANDS_DEST = path.join(CLAUDE_DIR, 'commands'); ... L36: if (!fs.existsSync(dest)) { L37: fs.mkdirSync(dest, { recursive: true }); L38: } ... L43: } else {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = scripts/install.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

dist/bin/helpers/logs.js#virtual:normalized:round1View file

117Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin/helpers/logs.js L117: function stripQuoted(q) { L118: return q.replace(/"(?:[^"\\]|\\.)*"/g, ' ');\n}\n/**\n * 带分析语句(SQL)的 query 用 `|` 分隔检索与分析两段。SLS 明确规定此时\n * line/offset 失效、要用 SQL 自己的 LIMIT 翻页 —— 这种 query 不能按页累加。\n *\n * 只看有没有 `|` 会... L119: }

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bin/helpers/logs.js#virtual:normalized:round1View on unpkg · L117

.claude/skills/yzsgo-e2e/bootstrap.pyView file

•path = .claude/skills/yzsgo-e2e/bootstrap.py kind = payload_in_excluded_dir sizeBytes = 2730 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/yzsgo-e2e/bootstrap.pyView on unpkg

•path = .claude/skills/yzsgo-e2e/bootstrap.py kind = build_helper sizeBytes = 2730 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/skills/yzsgo-e2e/bootstrap.pyView on unpkg

bin/helpers/verify-health.tsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = bin/helpers/verify-health.ts matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/helpers/verify-health.tsView on unpkg

dist/bin/helpers/discount/generate.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = [redacted].js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/discount/generate.jsView on unpkg

dist/bin/helpers/generate-test-token.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = dist/bin/helpers/generate-test-token.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/generate-test-token.jsView on unpkg

dist/bin/helpers/verify-health.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = dist/bin/helpers/verify-health.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/verify-health.jsView on unpkg

dist/bin/helpers/db-utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @optima-chat/dev-skills@0.14.0 matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.14.0 similarity = 0.603 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/helpers/db-utils.jsView on unpkg

dist/bin/helpers/query-db.jsView file

45patternName = generic_password severity = medium line = 45

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L45

50patternName = generic_password severity = medium line = 50

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L50

55patternName = generic_password severity = medium line = 55

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L55