registry / @saulwade/swl-ses / 2.4.3

@saulwade/swl-ses@2.4.3

Sistema de ingenieria de software auto-evolutivo multi-runtime polyglot con 60 agentes, 182 habilidades, 45 comandos, 77 reglas y 49 hooks. Soporta 11 lenguajes y 7 runtimes: Claude Code, OpenClaude, OpenCode, Gemini CLI, Cursor, Codex CLI (soporte comple

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time malicious behavior was confirmed. The package is an AI-agent platform extension installer with broad user-invoked writes to Claude/Codex/Cursor/OpenCode/Gemini control surfaces and optional MCP/hooks/Telegram capabilities.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI use such as npx swl-ses install, init, --with-mcp, or notification setup

Impact

Can add package-supplied instructions, skills, hooks, MCP config, and notification hooks to project or user AI runtime directories when the user runs installer commands.

Mechanism

user-invoked AI runtime extension and hook registration

Policy narrative

The package does not abuse npm postinstall: installation only prints a message. Risk comes from the product’s intended installer, which can place agents, skills, rules, hooks, generated AGENTS/CLAUDE-style instructions, and optional MCP/Telegram integration into AI runtime config directories. Those writes are explicit CLI-driven and mostly scoped to selected runtimes, so this is an agent extension lifecycle risk rather than confirmed malware.

Rationale

Source inspection supports a warn-level verdict: powerful AI-agent control-surface mutation exists, but it is package-aligned and activated by explicit CLI commands, not by npm lifecycle execution. No concrete credential exfiltration, hidden persistence, destructive behavior, or unconsented foreign agent hijack was confirmed.

Evidence

package.jsonbin/swl-ses.jsscripts/instalador.jsscripts/lib/hooks-settings.jsscripts/lib/transformadores/codex.jsscripts/lib/transformadores/cursor.jsscripts/lib/notificaciones-telegram.jsmanifiestos/hooks-config.jsonhooks/escaneo-secretos.jshooks/calidad-typescript.js.claude/settings.json.claude/agents/*.claude/skills/*.claude/commands/swl/*.claude/rules/*.codex/hooks.json.codex/AGENTS.md~/.codex/config.toml.cursor/mcp.json~/.claude/notifications/.env~/.claude/hooks/*.agents/skills/*

Network endpoints3

api.telegram.orgregistry.npmjs.org/api.github.com

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User-invoked install copies agents/skills/hooks into AI runtimes and registers hooks in project settings via scripts/instalador.js and scripts/lib/hooks-settings.js.
Codex/Cursor transformers can write AGENTS.md, hooks.json, .cursor/mcp.json, and ~/.codex/config.toml when install targets those runtimes.
Hooks include blocking PreToolUse and broad PostToolUse/Stop/UserPromptSubmit behavior from manifiestos/hooks-config.json.
Optional Telegram flow writes ~/.claude/notifications/.env and global notification hooks after explicit opt-in.

Evidence against

package.json postinstall only echoes installation instructions; no lifecycle code executes installer or mutates agent config.
CLI dispatch in bin/swl-ses.js requires explicit commands such as install/init/update before writes occur.
MCP registration is gated by --with-mcp and Telegram credentials by interactive/headless opt-in.
Network use found is package-aligned: Telegram notifications, npm version checks, GitHub/registry tooling, webhook server; no credential harvesting/exfiltration path confirmed.
Secret scanner finding is detection regex source in hooks/escaneo-secretos.js, not an embedded secret.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 342 file(s), 2.82 MB of source, external domains: api.github.com, cli.github.com, docs.github.com, evil.example.com, github.com, npm.pkg.github.com, registry.npmjs.org, t.me

Source & flagged code

19 flagged

package.jsonView file

Lines 11-51json

11 "files": [

12 "bin",

13 "scripts",

14 "manifiestos",

15 "agentes",

16 "habilidades",

17 "comandos",

18 "reglas",

19 "hooks",

20 "gateway",

21 "plantillas",

22 "contextos",

23 "instintos",

24 "schemas",

25 "_userland",

26 "plugin.json",

27 "CLAUDE.md",

28 "llms.txt"

29 ],

30 "scripts": {

31 "postinstall": "echo '\n swl-software-engineering-system instalado.\n Ejecuta: npx swl-ses init\n'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "test": "node --test tests/lib/*.test.js tests/scripts/*.test.js tests/scripts/lib/*.test.js tests/scripts/tui/*.test.js tests/hooks/*.test.js tests/hooks/lib/*.test.js tests/habilidades/*.test.js tests/gateway/*.test.js tests/bin/*.test.js tests/transformadores/*.test.js tests/mcp-server/*.test.js",

33 "test:validate": "node scripts/validar.js",

34 "test:manifest": "node scripts/validar-manifest.js",

35 "test:docs": "node scripts/verificar-docs-vs-codigo.js",

36 "test:smoke": "node scripts/smoke-test.js",

37 "test:aislamiento": "node scripts/validar-tests-aislamiento.js",

38 "test:all": "npm test && node scripts/validar.js && node scripts/validar-manifest.js && node scripts/verificar-docs-vs-codigo.js && node scripts/derivar-feature-list.js --check",

39 "test:userland": "node scripts/validar-userland-vacio.js",

40 "test:release": "npm run test:all && npm run test:userland && npm run test:smoke",

41 "doctor": "node scripts/doctor.js",

42 "prepack": "node scripts/limpiar-artefactos-python.js && node scripts/validar-userland-vacio.js",

43 "prepublishOnly": "npm run test:release",

44 "publish:all": "node scripts/publicar.js",

45 "publish:github": "node scripts/publicar.js --solo-github",

46 "publish:npmjs": "node scripts/publicar.js --solo-npmjs",

47 "publish:dry": "node scripts/publicar.js --dry-run",

48 "generate:docs": "node scripts/generar-inventario.js",

49 "gen-checklists": "node scripts/generar-checklists-consolidados.js",

50 "gen-checklists:check": "node scripts/generar-checklists-consolidados.js --check",

51 "gen:feature-list": "node scripts/derivar-feature-list.js",

hooks/escaneo-secretos.jsView file

Lines 45-85javascript

46/**

47 * Cada entrada describe un tipo de secreto con:

48 * - nombre: Etiqueta para el mensaje de error.

49 * - patron: Expresión regular para detectarlo.

50 * - ejemplos: Comentario ilustrativo (no se usa en código).

51 */

52const PATRONES_SECRETOS = [

53 {

54 nombre: 'Anthropic API Key (sk-ant-*)',

habilidades/changelog-generator/scripts/parse-commits.jsView file

Lines 6-56javascript

6 *

7 * Lee commits desde `git log` (entre dos refs o desde la última tag) y los

8 * clasifica según el spec de Conventional Commits 1.0.0:

9 * https://www.conventionalcommits.org/en/v1.0.0/

10 *

11 * Categorías generadas (formato Keep a Changelog):

hooks/lib/sync-status.jsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/lib/sync-status.jsView on unpkg · L1

3/**

4 * Sync Status — Detección de desincronización entre fuente y destino.

5 *

6 * Compara el directorio fuente (habilidades/, agentes/) con los directorios

7 * de instalación (.claude/skills/, .claude/agents/) para detectar:

8 * - Skills/agentes faltantes en destino

9 * - Skills/agentes modificados localmente (divergidos)

scripts/lib/autostart-macos.jsView file

Lines 1-28javascript

1'use strict';

3/**

4 * Generador de LaunchAgent plist para el daemon swl-telegram-bot en macOS.

5 *

6 * SEGURIDAD:

7 * - NUNCA escribe en ~/Library/LaunchDaemons — eso requiere root.

8 * Solo LaunchAgents (nivel usuario, sin privilegios de sistema).

9 * - NUNCA hardcodea rutas absolutas. Resuelve bin/ con __dirname en runtime.

10 * - NUNCA incluye credenciales en el plist — las credenciales viven en .env.

11 * - Solo opera en process.platform === 'darwin'. Otros OS reciben error explícito.

hooks/calidad-typescript.jsView file

Lines 285-325javascript

285 return violaciones;

286}

287

288/**

289 * 5. Ejecuta tsc --noEmit si el proyecto tiene tsconfig.json.

290 * Captura los primeros errores (no bloquea si tsc no está disponible).

291 *

292 * @returns {{ errores: string[], tiempoMs: number }}

293 */

294function ejecutarTsc() {

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView file

•path = habilidades/validacion-ci-sistema/scripts/validar-sistema.sh kind = build_helper sizeBytes = 13731 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView on unpkg

hooks/calidad-pre-commit.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @saulwade/swl-ses@2.3.0 matchedIdentity = npm:QHNhdWx3YWRlL3N3bC1zZXM:2.3.0 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/calidad-pre-commit.jsView on unpkg

habilidades/nestjs-experto/recursos/testing-nestjs.mdView file

Lines 32-72markdown

32 const module: TestingModule = await Test.createTestingModule({

33 providers: [

34 UsersService,

35 {

36 provide: getRepositoryToken(User),

37 useValue: crearMockRepositorio<User>(),

38 },

39 ],

40 }).compile();

42 service = module.get<UsersService>(UsersService);

43 repo = module.get<MockRepository<User>>(getRepositoryToken(User));

habilidades/gcp-cloud/SKILL.mdView file

100patternName = generic_password severity = medium line = 100 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in habilidades/gcp-cloud/SKILL.md

habilidades/gcp-cloud/SKILL.mdView on unpkg · L100

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = echo ' swl-software-engineering-system instalado. Ejecuta: npx swl-ses init '

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

hooks/escaneo-secretos.jsView file

65patternName = aws_access_key severity = critical line = 65 matchedText = // AKIAI...X...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/escaneo-secretos.jsView on unpkg · L65

65patternName = aws_access_key severity = critical line = 65 matchedText = // AKIAI...X...

Critical

Secret Pattern

AWS access key ID in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L65

78patternName = private_key_rsa severity = critical line = 78 matchedText = // -----...----

Critical

Secret Pattern

RSA private key in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L78

78patternName = private_key_openssh severity = critical line = 78 matchedText = // -----...----

Critical

Secret Pattern

OpenSSH private key in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L78

habilidades/changelog-generator/scripts/parse-commits.jsView file

36L37: const { execSync } = require('node:child_process'); L38:

High

Child Process

Package source references child process execution.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L36

26* Uso programático: L27: * const { parsearCommits, generarChangelog } = require('./parse-commits'); L28: * const { categorias, conformidad } = parsearCommits(commits);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L26

hooks/lib/sync-status.jsView file

1'use strict'; L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/lib/sync-status.jsView on unpkg · L1

scripts/lib/autostart-macos.jsView file

8* Solo LaunchAgents (nivel usuario, sin privilegios de sistema). L9: * - NUNCA hardcodea rutas absolutas. Resuelve bin/ con __dirname en runtime. L10: * - NUNCA incluye credenciales en el plist — las credenciales viven en .env. L11: * - Solo opera en process.platform === 'darwin'. Otros OS reciben error explícito. L12: * L13: * Rollback manual (si algo sale mal): L14: * launchctl unload -w ~/Library/LaunchAgents/com.swl.telegram-bot.plist L15: * rm ~/Library/LaunchAgents/com.swl.telegram-bot.plist ... L19: L20: const { execFileSync } = require('node:child_process'); L21: const path = require('node:path'); ... L50: } catch (_) {}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/lib/autostart-macos.jsView on unpkg · L8

hooks/calidad-typescript.jsView file

305try { L306: execSync('npx tsc --noEmit 2>&1', { L307: cwd: CWD, encoding: 'utf8', stdio: ['pipe','pipe','pipe'], timeout: 60_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/calidad-typescript.jsView on unpkg · L305

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView file

•path = habilidades/validacion-ci-sistema/scripts/validar-sistema.sh kind = build_helper sizeBytes = 13731 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView on unpkg

hooks/calidad-pre-commit.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/calidad-pre-commit.jsView on unpkg

habilidades/nestjs-experto/recursos/testing-nestjs.mdView file

52patternName = generic_password severity = medium line = 52 matchedText = password...34',

Medium

Secret Pattern