registry / @softure-ai/skills / 0.10.0
@softure-ai/skills@0.10.0
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe automatic hook changes project agent skills and instructions, creating a first-party extension lifecycle risk that warrants a warning. The inspected behavior is package-aligned and project-scoped, with manual mode as the default and manifest-driven cleanup; it does not establish a malicious attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm runs the package’s postinstall hook during installation.
Impact
The install changes which skills and instructions are available to project agents; no data transfer or unrelated control-surface change was established.
Mechanism
The installer copies shipped skills into the project’s Claude skills directory and writes selected package rules into AGENTS.md or CLAUDE.md.
AI rationale
The automatic hook changes project agent skills and instructions, creating a first-party extension lifecycle risk that warrants a warning. The inspected behavior is package-aligned and project-scoped, with manual mode as the default and manifest-driven cleanup; it does not establish a malicious attack.
Evidence
package.jsonscripts/install.mjsscripts/uninstall.mjs.claude/skills/<skill>/AGENTS.mdCLAUDE.md.claude/softure-skills.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The installer and uninstaller share the project manifest and managed-block markers; the uninstaller removes skills recorded in that manifest.
- The package’s postinstall hook automatically runs the installer.
- The installer copies this package’s skills into the consuming project’s Claude skills directory.
- The installer selects the project’s AGENTS.md or CLAUDE.md and writes a managed rules block there.
- The installer defaults to manual operating mode.
- The uninstaller removes the recorded skills and processes the managed project files.
Evidence against
- The setup installs this package’s own skills and rules into the consuming project, matching the package’s stated purpose.
- The installer defaults to manual mode and provides manifest-driven cleanup.
Behavioral surface
EnvironmentVarsFilesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.mjs --postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.mjs --postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.mjsView file
2// Installs SOFTURE skills into a consumer project:
L3: // skills/<name>/ -> <project>/.claude/skills/<name>/
L4: // rules/AGENTS.md -> managed block in AGENTS.md (or CLAUDE.md when only that exists)
L5: // managed block in .gitignore, so installed skills are restored by `npm install`, never committed
L6: // manifest -> <project>/.claude/softure-skills.json (drives updates and uninstall)
L7: //
...
L22: const PACKAGE = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf8"));
L23: const MANIFEST_PATH = path.join(".claude", "softure-skills.json");
L24: const BLOCK_BEGIN = "<!-- softure-skills:begin (managed by @softure-ai/skills, do not edit) -->";
...
L28: const WORKFLOW_CONFIG_PATH = path.join("context", "workflow.json");
L29: // Section
Findings
1 Critical3 High6 Medium2 Low
CriticalAi Agent Control Hijackscripts/install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighExternal Ai Agent Control Surface Mutationscripts/install.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helperskills/softure-worktree/scripts/wt-status.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencescripts/install.mjs
MediumAi Review Evidencescripts/uninstall.mjs
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @softure-ai/skills@0.10.0.
See all versions of @softure-ai/skills for other recorded verdicts.
- Review the evidence and your use of @softure-ai/skills@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.