registry / @routerhub/agent-rules / 1.5.148

@routerhub/agent-rules@1.5.148

Shared Copilot agent rules and guidelines for RouterHub projects

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic install hook modifies the consumer project and installs package-provided AI-agent control content. No network endpoint or credential collection was identified.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm runs postinstall when the dependency is installed or updated.

Impact

The package can alter broad AI-agent behavior and suppress review coverage in a consumer project without an explicit user command.

Mechanism

postinstall.js appends .npmrc settings, then runs merge.js, which writes agent instruction files and copies Claude skills into the consumer project.

Policy narrative

Installing the package automatically invokes its postinstall hook. That hook changes the consumer .npmrc and starts the merger in the consumer project. The merger installs rules into common AI-agent instruction locations, copies Claude skills, and generates a review-skip instruction for its generated files. This is unconsented lifecycle mutation of a broad AI-agent control surface.

AI rationale

The automatic lifecycle hook performs broad consumer-project AI-agent configuration changes rather than limiting work to the package directory or an explicit user command. This meets the install-control-surface blocking policy.

Evidence

package.jsonpostinstall.jsmerge.js.npmrcAGENTS.mdCLAUDE.md.github/copilot-instructions.md.github/instructions/.claude/skills/

@routerhub/agent-rules@1.5.148

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code