registry / AI-agent control-surface risk / @realchemistry/auth-guard
@realchemistry/auth-guard
Sealed OIDC + PKCE chassis for Real Chemistry's Auth Hub. `auth-guard serve` runs the auth front door; consumer apps stay blind to OIDC and read identity from x-rc-user-* headers.
This report shows the evidence for @realchemistry/auth-guard@2.2.16. 3 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource confirms that postinstall mutates the consumer project's agent instructions and skill directory without an affirmative consent gate. This meets the policy for unconsented install-time mutation of a foreign AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package with lifecycle scripts enabled runs its postinstall hook.
Impact
Agents operating in the consumer project receive instructions selected by the package during installation.
Mechanism
The hook copies skills into the consumer's .local/skills directory and creates or edits the root AGENTS.md using bundled instructions; the opt-out is disabled by default.
Policy narrative
The package's postinstall hook automatically installs agent skills and writes package-provided instructions into the consumer project's root AGENTS.md. Although the edit uses a marked section and can be opted out of with an environment variable, neither is affirmative consent to modifying the consumer's agent control surface during installation.
AI rationale
Source confirms that postinstall mutates the consumer project's agent instructions and skill directory without an affirmative consent gate. This meets the policy for unconsented install-time mutation of a foreign AI-agent control surface.
Evidence
package.jsonscripts/install-skill.mjsskill/AGENTS.snippet.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install-skill.mjs from postinstall.
- The postinstall installer uses the consumer project root and copies package-provided agent skills into its .local/skills directory.
- The installer creates or updates the consumer root AGENTS.md with package-provided rules during postinstall.
- The bundled AGENTS snippet adds persistent instructions for agents working in the consumer project.
- The packed-consumer check confirms that installation creates AGENTS.md with the package marker.
Evidence against
- The installer provides AUTH_GUARD_SKIP_SKILL_INSTALL=1 as an opt-out and limits AGENTS.md replacement to a marked section.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/install-skill.mjsView file
9* to wire the SDK in.
L10: * 2. Merge the bundled AGENTS.md snippet (skill/AGENTS.snippet.md) into
L11: * the consumer project's AGENTS.md at the project root so the next
L12: * agent that touches the project inherits the RC auth guardrails.
...
L14: * Both are idempotent: the skill file overwrites on every install (pinned to
L15: * the installed SDK version); the AGENTS.md merge replaces only the section
L16: * between <!-- BEGIN @realchemistry/auth-guard --> and <!-- END … --> markers,
L17: * leaving any other content in the user's AGENTS.md intact.
L18: *
...
L24: import {
L25: mkdirSync,
L26: copyFileSync,
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skill.mjsView on unpkg · L9Findings
1 Critical2 High3 Medium6 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/probe.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @realchemistry/auth-guard@2.2.16.
The versions list below shows the verdict for each recorded version.
- Avoid installing @realchemistry/auth-guard@2.2.16. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.