registry / @supernal/interface / 1.1.2

@supernal/interface@1.1.2

Universal AI Interface - Make any application AI-controllable with decorators (Open Source Edition)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically writes a bundled agent skill into the user's global OpenClaw control surface. This affects future OpenClaw agent discovery without an explicit setup command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

A package installation mutates a broad AI-agent configuration surface and installs agent instructions without consent.

Mechanism

Recursive copy into ~/.openclaw/skills/si

Policy narrative

Installing the package invokes its postinstall hook. Outside CI, that hook creates ~/.openclaw/skills/si and copies every bundled skill file there. The destination is a user-wide OpenClaw skills directory, so the package changes an AI-agent discovery and control surface without requiring the user to run an explicit setup command.

Rationale

The automatic postinstall mutation of a foreign, user-wide AI-agent skills directory meets the install-control-surface block policy. No exfiltration was found, but it is not required for this concrete unconsented control-surface write.

Evidence

package.jsonscripts/postinstall.jsskill/SKILL.md~/.openclaw/skills/si

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with false-positive risk.

@supernal/interface@1.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code