Loading npm security reports…

@quotient-forecasting/cassie-skill@0.4.10: AI-agent | LPM Firewall

registry / @quotient-forecasting/cassie-skill / 0.4.10

@quotient-forecasting/cassie-skill@0.4.10

Agent Skill operator manual and policy files for Cassie

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies two user-level AI-agent skill directories. It installs instructions that enable agents to operate trading functions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

An installed agent may discover and follow new trading-bot instructions without the user's explicit setup action.

Mechanism

Copies a behavior-bearing skill into external AI-agent skill directories

Policy narrative

On npm installation, postinstall runs install.mjs. Unless an opt-out variable is set, it creates cassie directories in ~/.agents/skills and ~/.claude/skills and overwrites the installed skill and thesis policy files. Those files supply agent-facing instructions for trading-bot, wallet, funding, deployment, and trade operations. This is an unconsented install-time mutation of broad external AI-agent control surfaces.

AI rationale

The package has no observed exfiltration or remote execution, but its automatic postinstall writes behavior-bearing content into two foreign user-level agent skill roots. This meets the install-control-surface blocking policy.

Evidence

package.jsoninstall.mjsSKILL.mdthesis~/.agents/skills/cassie/SKILL.md~/.agents/skills/cassie/thesis~/.claude/skills/cassie/SKILL.md~/.claude/skills/cassie/thesis

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

36"scripts": { "postinstall": "node install.mjs" }

High

Suspicious Lifecycle Evidence

The package runs install.mjs automatically through a postinstall hook.

package.jsonView on unpkg · L36

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.mjsView file

3L4: import { cpSync, existsSync, mkdirSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L12: function defaultRoots() { L13: return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; L14: } ... L27: const destination = join(root, "cassie"); L28: mkdirSync(destination, { recursive: true }); L29: cpSync(join(packageDir, "SKILL.md"), join(destination, "SKILL.md"), { force: true }); L30: cpSync(join(packageDir, "thesis"), join(destination, "thesis"), { recursive: true, force: true }); L31: installed.push(destination);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L3

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { cpsync, existssync, mkdirsync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fileurltopath } from "node:url"; const packagedir = dirname(fileurltopath(import.meta.url)); const workspaceroot = resolve(packagedir, "../.."); function defaultroots() { return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; } export function installcassieskill(options = {}) { const override = process.env.cassie_skills_dir?.trim(); if (!options.force && process.env.cassie_skip_skill_install === "1") return [];

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.mjsView on unpkg

12function defaultRoots() { return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; }