Loading npm security reports…

@optima-chat/dev-skills@0.16.6: AI-agent control-surface risk | LPM Firewall

registry / @optima-chat/dev-skills / 0.16.6

@optima-chat/dev-skills@0.16.6

Claude Code Skills for Optima development team - cross-environment collaboration tools

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the user's Claude and Codex agent configuration directories. It adds all bundled commands and skills, expanding the agent control surface without an explicit setup action.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation invokes the postinstall lifecycle hook.

Impact

Package-supplied agent instructions and executable skill assets become available in the user's existing AI-agent environments.

Mechanism

Automatic recursive copying into global Claude and Codex skills directories.

Policy narrative

The package's postinstall hook runs automatically. Its installer creates the user's global Claude configuration directories, copies every bundled command and skill there, and copies every bundled Codex skill into the configured Codex home. This is an unconsented install-time mutation of broad AI-agent control surfaces; future agent sessions can discover and follow package-provided instructions or execute bundled assets.

AI rationale

The postinstall hook automatically writes package content into global Claude and Codex agent directories. This concrete, broad agent-control-surface mutation meets the install-time blocking policy despite no network activity in the installer itself.

Evidence

package.jsonscripts/install.js.claude/commands.claude/skills$CODEX_HOME/skills/optima-dev

Decision evidence

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/helpers/query-db.tsView file

2L3: import { execSync } from 'child_process'; L4: import * as fs from 'fs'; ... L97: // 1. 优先从 PATH 中查找 L98: const whichCmd = process.platform === 'win32' ? 'where psql' : 'which psql'; L99: try { ... L133: : process.platform === 'win32' L134: ? 'Download from https://www.postgresql.org/download/windows/' L135: : 'sudo apt install postgresql-client'; ... L146: encoding: 'utf-8', L147: env: { ...process.env, PGPASSWORD: password } L148: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers/query-db.tsView on unpkg · L2

16patternName = generic_password severity = medium line = 16

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/helpers/query-db.tsView on unpkg · L16

21patternName = generic_password severity = medium line = 21

Medium

Secret Pattern

Hardcoded password in bin/helpers/query-db.ts

bin/helpers/query-db.tsView on unpkg · L21

26patternName = generic_password severity = medium line = 26

Medium

Secret Pattern

Hardcoded password in bin/helpers/query-db.ts

bin/helpers/query-db.tsView on unpkg · L26

bin/helpers/infisical-secrets.tsView file

1import { execSync } from 'child_process'; L2: import { getInfisicalConfig, getInfisicalToken, InfisicalConfig } from './db-utils';

High

Child Process

Package source references child process execution.

bin/helpers/infisical-secrets.tsView on unpkg · L1

bin/helpers/db-utils.tsView file

280// fd 随 bash 进程退出自动关闭。 L281: execSync(`bash -c 'exec 3<>/dev/tcp/127.0.0.1/${localPort}'`, { stdio: 'ignore', timeout: 2000 }); L282: return true;

High

Shell

Package source references shell execution.

bin/helpers/db-utils.tsView on unpkg · L280

bin/helpers/logs.ts#virtual:normalized:round1View file

119function stripQuoted(q: string): string { L120: return q.replace(/"(?:[^"\\]|\\.)*"/g, ' ');\n}\n\n/**\n * 带分析语句(SQL)的 query 用 `|` 分隔检索与分析两段。SLS 明确规定此时\n * line/offset 失效、要用 SQL 自己的 LIMIT 翻页 —— 这种 query 不能按页累加。\n *\n * 只看有没有 `|`... L121: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/helpers/logs.ts#virtual:normalized:round1View on unpkg · L119

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/helpers/logs.ts#virtual:normalized:round1View on unpkg

scripts/install.jsView file

6L7: const CLAUDE_DIR = path.join(os.homedir(), '.claude'); L8: const SKILLS_SOURCE = path.join(__dirname, '..', '.claude'); L9: const CODEX_DIR = process.env.CODEX_HOME L10: ? path.resolve(process.env.CODEX_HOME) L11: : path.join(os.homedir(), '.codex'); L12: const CODEX_SOURCE = path.join(__dirname, '..', '.codex'); L13: const COMMANDS_DEST = path.join(CLAUDE_DIR, 'commands'); ... L36: if (!fs.existsSync(dest)) { L37: fs.mkdirSync(dest, { recursive: true }); L38: } ... L43: } else {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = scripts/install.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

dist/bin/helpers/logs.js#virtual:normalized:round1View file

117Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin/helpers/logs.js L117: function stripQuoted(q) { L118: return q.replace(/"(?:[^"\\]|\\.)*"/g, ' ');\n}\n/**\n * 带分析语句(SQL)的 query 用 `|` 分隔检索与分析两段。SLS 明确规定此时\n * line/offset 失效、要用 SQL 自己的 LIMIT 翻页 —— 这种 query 不能按页累加。\n *\n * 只看有没有 `|` 会... L119: }

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bin/helpers/logs.js#virtual:normalized:round1View on unpkg · L117

.claude/skills/yzsgo-e2e/bootstrap.pyView file

•path = .claude/skills/yzsgo-e2e/bootstrap.py kind = payload_in_excluded_dir sizeBytes = 2730 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/yzsgo-e2e/bootstrap.pyView on unpkg

•path = .claude/skills/yzsgo-e2e/bootstrap.py kind = build_helper sizeBytes = 2730 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/skills/yzsgo-e2e/bootstrap.pyView on unpkg

dist/bin/helpers/billing-http.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = dist/bin/helpers/billing-http.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/billing-http.jsView on unpkg

dist/bin/helpers/cn-deploy.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = dist/bin/helpers/cn-deploy.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/cn-deploy.jsView on unpkg

dist/bin/helpers/discount/generate.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = [redacted].js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/discount/generate.jsView on unpkg

dist/bin/helpers/generate-test-token.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = dist/bin/helpers/generate-test-token.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/generate-test-token.jsView on unpkg

dist/bin/helpers/show-env.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = dist/bin/helpers/show-env.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/show-env.jsView on unpkg

bin/helpers/billing-http.tsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = bin/helpers/billing-http.ts matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/helpers/billing-http.tsView on unpkg

bin/helpers/cn-deploy.tsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = bin/helpers/cn-deploy.ts matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/helpers/cn-deploy.tsView on unpkg

bin/helpers/show-env.tsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.7 matchedPath = bin/helpers/show-env.ts matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/helpers/show-env.tsView on unpkg

dist/bin/helpers/db-utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @optima-chat/dev-skills@0.14.0 matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.14.0 similarity = 0.809 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/helpers/db-utils.jsView on unpkg

dist/bin/helpers/query-db.jsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L44

49patternName = generic_password severity = medium line = 49

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L49

54patternName = generic_password severity = medium line = 54

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L54