Loading npm security reports…

@quotient-forecasting/cassie-skill@0.4.12: AI-agent | LPM Firewall

registry / @quotient-forecasting/cassie-skill / 0.4.12

@quotient-forecasting/cassie-skill@0.4.12

Agent Skill operator manual and policy files for Cassie

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically adds or replaces a Cassie agent skill in two home-directory agent control surfaces. That skill gives agents instructions for operating trading bots, funding, withdrawals, and deployments.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs node install.mjs during package installation.

Impact

It can alter the capabilities and operating guidance available to Claude and other configured agents without a separate user command.

Mechanism

Automatic writes to home-directory AI-agent skill directories.

Policy narrative

An npm postinstall invokes the installer automatically. It resolves two agent skill roots under the user's home directory, creates a cassie subdirectory, and copies this package's skill and policy files there with overwrite enabled. The copied skill guides agents to operate trading bots and includes funding, withdrawal, deployment, and trade-related workflows. This is an unconsented install-time mutation of broad external AI-agent control surfaces.

AI rationale

The lifecycle hook automatically writes behavior-bearing files into both .agents and .claude home directories. Although no exfiltration or remote execution is present, this satisfies the policy for malicious install-time AI-agent control-surface mutation.

Evidence

package.jsoninstall.mjsSKILL.md~/.agents/skills/cassie/SKILL.md~/.agents/skills/cassie/thesis~/.claude/skills/cassie/SKILL.md~/.claude/skills/cassie/thesis

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

36"scripts": { "postinstall": "node install.mjs" }

High

Ai Review Evidence

The manifest runs install.mjs automatically after npm installation.

package.jsonView on unpkg · L36

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.mjsView file

3L4: import { cpSync, existsSync, mkdirSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L12: function defaultRoots() { L13: return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; L14: } ... L27: const destination = join(root, "cassie"); L28: mkdirSync(destination, { recursive: true }); L29: cpSync(join(packageDir, "SKILL.md"), join(destination, "SKILL.md"), { force: true }); L30: cpSync(join(packageDir, "thesis"), join(destination, "thesis"), { recursive: true, force: true }); L31: installed.push(destination);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L3

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { cpsync, existssync, mkdirsync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fileurltopath } from "node:url"; const packagedir = dirname(fileurltopath(import.meta.url)); const workspaceroot = resolve(packagedir, "../.."); function defaultroots() { return [join(homedir(), ".agents", "skills"), join(homedir(), ".claude", "skills")]; } export function installcassieskill(options = {}) { const override = process.env.cassie_skills_dir?.trim(); if (!options.force && process.env.cassie_skip_skill_install === "1") return [];

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0da900ca224fb098 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @quotient-forecasting/cassie-skill@0.4.10 matchedPath = install.mjs matchedIdentity = npm:[redacted]:0.4.10 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious