Loading npm security reports…

@quotient-forecasting/cassie-skill@0.2.0: AI-agent | LPM Firewall

registry / @quotient-forecasting/cassie-skill / 0.2.0

@quotient-forecasting/cassie-skill@0.2.0

Agent Skill operator manual and policy files for Cassie

AI Security Review

scanned 18d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package automatically modifies two user-level AI-agent skill directories. It creates and overwrites the Cassie skill files without requiring an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs node install.mjs during package installation.

Impact

This is unconsented install-time mutation of broad AI-agent control surfaces; future agent sessions may load package-supplied operational instructions.

Mechanism

The installer selects ~/.agents/skills and ~/.claude/skills by default, creates cassie subdirectories, and force-copies SKILL.md and thesis into them.

Policy narrative

A normal npm installation invokes the postinstall hook. That hook writes a Cassie skill into both generic .agents and Claude skill locations in the user home directory, overwriting existing files at those package-controlled paths. These locations influence AI-agent behavior and are modified without an explicit user setup action.

AI rationale

The package has a concrete automatic lifecycle path that writes behavior-bearing files into foreign, broad AI-agent control surfaces. Although no network or credential sink appears in the installer, the install-time control-surface mutation meets the blocking policy.

Evidence

package.jsoninstall.mjs~/.agents/skills/cassie/SKILL.md~/.agents/skills/cassie/thesis~/.claude/skills/cassie/SKILL.md~/.claude/skills/cassie/thesis

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

37"postinstall": "node install.mjs"

High

Ai Review Evidence

The manifest automatically runs install.mjs after installation.

package.jsonView on unpkg · L37

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.mjsView file

3L4: import { cpSync, existsSync, mkdirSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L12: function defaultRoots() { L13: return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; L14: } ... L27: const destination = join(root, "cassie"); L28: mkdirSync(destination, { recursive: true }); L29: cpSync(join(packageDir, "SKILL.md"), join(destination, "SKILL.md"), { force: true }); L30: cpSync(join(packageDir, "thesis"), join(destination, "thesis"), { recursive: true, force: true }); L31: installed.push(destination);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L3

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { cpsync, existssync, mkdirsync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fileurltopath } from "node:url"; const packagedir = dirname(fileurltopath(import.meta.url)); const workspaceroot = resolve(packagedir, "../.."); function defaultroots() { return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; } export function installcassieskill(options = {}) { const override = process.env.cassie_skills_dir?.trim(); if (!options.force && process.env.cassie_skip_skill_install === "1") return [];

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0da900ca224fb098 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @quotient-forecasting/cassie-skill@0.4.16 matchedPath = install.mjs matchedIdentity = npm:[redacted]:0.4.16 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

install.mjsView on unpkg

12function defaultRoots() { return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; }

High

Ai Review Evidence

The installer defaults to writing a skill into both ~/.agents/skills and ~/.claude/skills.

install.mjsView on unpkg · L12

27const destination = join(root, "cassie"); mkdirSync(destination, { recursive: true }); cpSync(join(packageDir, "SKILL.md"), join(destination, "SKILL.md"), { force: true }); cpSync(join(packageDir, "thesis"), join(destination, "thesis"), { recursive: true, force: true });

High

Suspicious Lifecycle Evidence

The lifecycle installer creates those destinations and force-overwrites SKILL.md and thesis content.

install.mjsView on unpkg · L27