Loading npm security reports…

@paulduvall/claude-dev-toolkit: AI-agent control-surface risk | LPM Firewall

registry / @paulduvall/claude-dev-toolkit / 0.0.1-alpha.23

@paulduvall/claude-dev-toolkit@0.0.1-alpha.23

Custom commands toolkit for Claude Code - streamline your development workflow

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook automatically changes the user's global Claude command surface. Non-interactive installation installs bundled commands and can overwrite existing commands without consent.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the npm package with non-interactive stdin, or enabling skip-setup.

Impact

Changes agent instructions available across projects and can replace existing slash commands.

Mechanism

The lifecycle script recursively copies bundled Markdown files into the global .claude/commands directory using unconditional file replacement.

Policy narrative

Npm installation activates the postinstall script. When stdin is non-interactive, the script copies all bundled Markdown commands into the user's global Claude command directory without a confirmation step. Existing files with matching names are overwritten. The skip-setup option also enters this copying path. This creates an unconsented install-time mutation of a foreign agent control surface.

AI rationale

The inspected lifecycle performs unconsented writes to Claude's global command surface, including unconditional replacement of existing commands. This meets the supplied blocking rule for install-time agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.js.claude/commands

Decision evidence

public snapshot

with false-positive risk.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/hook-metadata-service.jsView file

45description: this._getHookDescription(hookPath), L46: metadata: this._getHookMetadata(hookPath), L47: valid: this._isHookValid(hookPath), ... L178: /** L179: * Check if cache is valid (private method) L180: * @returns {boolean} True if cache is valid ... L196: _getSourceHooksDirectory() { L197: return path.join(__dirname, '../hooks'); L198: } ... L331: // Basic validation: should have shebang and be executable L332: const validShebangs = ['#!/bin/bash', '#!/bin/sh', '#!/usr/bin/env bash', '#!/usr/bin/env sh']; L333: const hasValidShebang = validShebangs.some(shebang => content.startsWith(shebang));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/hook-metadata-service.jsView on unpkg · L45

scripts/postinstall.jsView file

6L7: const skipSetup = process.env.CLAUDE_SKIP_SETUP === 'true' || L8: process.argv.includes('--skip-setup'); ... L15: if (fs.existsSync(dirPath)) return; L16: fs.mkdirSync(dirPath, { recursive: true }); L17: console.log(` Created ${label}`); ... L21: const homeDir = os.homedir(); L22: const claudeDir = path.join(homeDir, '.claude'); L23: return { ... L38: } else if (item.endsWith('.md')) { L39: fs.copyFileSync(src, path.join(targetDir, item)); L40: console.log(` Installed command: ${item}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require('fs'); const path = require('path'); const os = require('os'); const skipsetup = process.env.claude_skip_setup === 'true' || process.argv.includes('--skip-setup'); console.log('setting up claude custom commands...'); function ensuredir(dirpath, label) { if (fs.existssync(dirpath)) return; fs.mkdirsync(dirpath, { recursive: true }); console.log(` created ${label}`); } function getclaudedirs() { const homedir = os.homedir(); const claudedir = path.join(homedir, '.claude'); return { claudedir, commandsdir: path.join(claudedir, 'commands'), hooksdir: path.join(claud

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

hooks/check_ash_expirations.pyView file

•path = hooks/check_ash_expirations.py kind = build_helper sizeBytes = 6800 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/check_ash_expirations.pyView on unpkg

lib/context-utils.jsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/context-utils.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 7-47json

7 "keywords": [

8 "claude-code",

9 "claude",

10 "ai",

11 "development",

12 "automation",

13 "commands"

14 ],

15 "repository": {

16 "type": "git",

17 "url": "git+https://github.com/PaulDuvall/claude-code.git"

18 },

19 "bugs": {

20 "url": "https://github.com/PaulDuvall/claude-code/issues"

21 },

22 "homepage": "https://github.com/PaulDuvall/claude-code#readme",

23 "bin": {

24 "claude-commands": "bin/claude-commands"

25 },

26 "scripts": {

27 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "node scripts/run-all-tests.js",

29 "test:report": "node scripts/generate-test-report.js",

30 "test:comprehensive": "node tests/test_all_suites.js",

31 "test:req007": "node tests/test_req_007_interactive_setup_wizard.js",

32 "test:req009": "node tests/test_req_009_configuration_template_application.js",

33 "test:req018": "node tests/test_req_018_security_hook_installation.js",

34 "test:req020": "node tests/test_req_020_installation_failure_recovery.js",

35 "test:commands": "node tests/test_command_validation.js",

36 "test:workflow": "node tests/test_core_workflow_commands.js",

37 "test:security": "node tests/test_security_commands.js",

38 "test:quality": "node tests/test_quality_commands.js",

39 "test:git": "node tests/test_git_commands.js",

40 "test:ux": "node tests/test_user_experience.js",

41 "test:validation": "node tests/test_validation_system.js",

42 "test:subagents": "node tests/test_subagents_command.js",

43 "test:subagents-async": "node tests/test_subagents_async.js",

44 "test:config": "node tests/test_config_command.js",

45 "test:ux-quick-start": "node tests/test_ux_quick_start_guide.js",

46 "test:npm-completeness": "node tests/test_npm_package_completeness.js",

47 "test:install": "scripts/publishing/test-package-install.sh",

lib/hook-metadata-service.jsView file

Lines 25-65javascript

25 }

26

27 const sourceHooksDir = this._getSourceHooksDirectory();

28

29 if (!fs.existsSync(sourceHooksDir)) {

30

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2

3const fs = require('fs');

4const path = require('path');

5const

hooks/check_ash_expirations.pyView file

•path = hooks/check_ash_expirations.py kind = build_helper sizeBytes = 6800 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/check_ash_expirations.pyView on unpkg

lib/context-utils.jsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/context-utils.jsView on unpkg