@softure-ai/skills@0.5.0
SOFTURE agent skills: a spec-driven delivery workflow (shape → prd → roadmap → plan → implement → review) plus parallel worktree orchestration
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package has an automatic postinstall that mutates a consumer project's AI-agent instruction surface without an explicit consent gate. This meets the policy for unconsented postinstall mutation of a foreign AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs the package's postinstall hook.
Impact
The package changes files that guide AI agent behavior in the consuming project.
Mechanism
The hook copies skills into .claude/skills and adds a managed rules block to AGENTS.md or, when appropriate, CLAUDE.md without an explicit consent check.
Policy narrative
During npm installation, the postinstall hook invokes the installer. It copies shipped skill content into the consumer project's Claude skills directory and writes rules into an agent instruction file. No source-level consent prompt or opt-in gate precedes these writes.
AI rationale
The package has an automatic postinstall that mutates a consumer project's AI-agent instruction surface without an explicit consent gate. This meets the policy for unconsented postinstall mutation of a foreign AI-agent control surface.
Evidence
package.jsonscripts/install.mjsscripts/uninstall.mjs.claude/skills/AGENTS.mdCLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install.mjs automatically during postinstall.
- The installer copies package skills into the consumer project's .claude/skills directory.
- The installer injects package rules into the consumer's AGENTS.md or CLAUDE.md without a consent gate.
- The install routine runs when the postinstall command invokes the installer.
Evidence against
- The installer skips existing skill folders that are not recorded as managed by this package.
- The uninstall script removes only recorded skills and managed blocks from listed files.
Behavioral surface
EnvironmentVarsFilesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.mjs --postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg22"scripts": {
"postinstall": "node scripts/install.mjs --postinstall",
"validate"
High
Suspicious Lifecycle Evidence
package.json runs scripts/install.mjs automatically during postinstall.
package.jsonView on unpkg · L22•scripts.postinstall = node scripts/install.mjs --postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.mjsView file
Findings
1 Critical5 High4 Medium2 Low
CriticalAi Agent Control Hijackscripts/install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighExternal Ai Agent Control Surface Mutationscripts/install.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install.mjs
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/install.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helperskills/softure-worktree/scripts/wt-status.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @softure-ai/skills@0.5.0.
See all versions of @softure-ai/skills for other recorded verdicts.
- Avoid installing @softure-ai/skills@0.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.