registry / @tera-system/core / 0.2.4

@tera-system/core@0.2.4

Tera System OpenCode Plugin â€” governance core, 20 agents, 11 commands, distribution tools (personal edition)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consumer workspace and its OpenCode control surface. It can install enabled MCP command definitions without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation, which runs postinstall.

Impact

A package installation can establish and enable AI-agent capabilities in a consumer project, including npx-resolved MCP commands.

Mechanism

Postinstall copies agent files, commands, configuration, tools, and assets into the initiating workspace.

Policy narrative

npm invokes scripts/install.js automatically. The script targets INIT_CWD, populates .opencode with agents and commands, and writes an OpenCode configuration if none exists. That configuration enables MCP commands through npx -y, creating a broad AI-agent control surface in the consumer project without an explicit setup action.

Rationale

This is an unconsented postinstall mutation of a foreign AI-agent control surface, including enabled command definitions. Conflict protection does not remove the risk because a new workspace receives the configuration and agent content automatically.

Evidence

package.jsonscripts/install.jsopencode.tera.example.json.opencode/agents/.opencode/commands/.opencode/opencode.json.opencode/opencode.tera.example.json.opencode/tera-core.manifest.jsontera-system/tools/project-control/tera-workshop/.tera/license.state.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

A postinstall hook automatically runs the workspace-mutating installer.
The installer selects npm's initiating directory as its target without requiring a user command.
It installs agent and command files into the target's .opencode directory.
It creates an OpenCode configuration when absent, enabling MCP commands that use npx -y.
It also copies tools, assets, and package-owned governance files into the consumer workspace.

Evidence against

The installer preserves conflicting existing files and makes backups before updating files it considers owned.
No source evidence shows credential exfiltration, remote payload download, or hidden shell execution during installation.
The configured Structurizr service is disabled and points only to localhost.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 14 file(s), 35.6 KB of source, external domains: www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 9-43json

9 },

10 "files": [

11 "agents",

12 "commands",

13 "core",

14 "assets",

15 "tools",

16 "scripts",

17 "MANIFEST.json",

18 "opencode.tera.example.json",

19 "WELCOME.md",

20 "README.md",

21 "LICENSE.md",

22 "RELEASES.md"

23 ],

24 "bin": {

25 "tera-restore": "scripts/install.js",

26 "tera-core-restore": "scripts/install.js"

27 },

28 "scripts": {

29 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 },

31 "keywords": [

32 "opencode",

33 "plugin",

34 "tera",

35 "governance",

36 "agents",

37 "component"

38 ],

39 "publishConfig": {

40 "access": "public"

41 }

42}

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * @tera/core installer

4 * --------------------------------------------------------------

5 * NON-DESTRUCTIVE + OWNERSHIP-AWARE installer for the Tera System

6 * OpenCode Plugin component.

7 *

8 * Rules:

9 * - Never deletes anything.

10 * - Never overwrites a file it does not own.

11 * - Tracks ownership via `.opencode/tera-core.manifest.json`.

tools/tera-fetch.ps1View file

•path = tools/tera-fetch.ps1 kind = build_helper sizeBytes = 6816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/tera-fetch.ps1View on unpkg

assets/project-control/TeraPricingCalculator.xlsxView file

•path = assets/project-control/TeraPricingCalculator.xlsx kind = high_entropy_blob sizeBytes = 21531 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/project-control/TeraPricingCalculator.xlsxView on unpkg

•path = assets/project-control/TeraPricingCalculator.xlsx kind = compressed_blob sizeBytes = 21531 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/project-control/TeraPricingCalculator.xlsxView on unpkg

•path = assets/project-control/TeraPricingCalculator.xlsx kind = nested_archive_needs_inspection sizeBytes = 21531 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/project-control/TeraPricingCalculator.xlsxView on unpkg

scripts/build.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tera-system/core@0.1.5 matchedIdentity = npm:QHRlcmEtc3lzdGVtL2NvcmU:0.1.5 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/build.mjsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

10* - Never overwrites a file it does not own. L11: * - Tracks ownership via `.opencode/tera-core.manifest.json`. L12: * - Only updates files it owns, always keeping a backup first. L13: * - Idempotent: re-running is safe; identical files are skipped. L14: * - Never touches an existing user `opencode.json`. L15: * ... L65: function copyFile(src, dest) { L66: fs.mkdirSync(path.dirname(dest), { recursive: true }); L67: fs.copyFileSync(src, dest); L68: } ... L70: function loadOwnership(target) { L71: const p = path.join(target, ".opencode", MANIFEST_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L10

tools/tera-fetch.ps1View file

•path = tools/tera-fetch.ps1 kind = build_helper sizeBytes = 6816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/tera-fetch.ps1View on unpkg

assets/project-control/TeraPricingCalculator.xlsxView file

•path = assets/project-control/TeraPricingCalculator.xlsx kind = high_entropy_blob sizeBytes = 21531 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/project-control/TeraPricingCalculator.xlsxView on unpkg

•path = assets/project-control/TeraPricingCalculator.xlsx kind = compressed_blob sizeBytes = 21531 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/project-control/TeraPricingCalculator.xlsxView on unpkg

•path = assets/project-control/TeraPricingCalculator.xlsx kind = nested_archive_needs_inspection sizeBytes = 21531 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/project-control/TeraPricingCalculator.xlsxView on unpkg

scripts/build.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/build.mjsView on unpkg

Findings

1 Critical3 High5 Medium6 Low

CriticalAi Agent Control Hijackscripts/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobassets/project-control/TeraPricingCalculator.xlsx

HighPrevious Version Dangerous Deltascripts/build.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helpertools/tera-fetch.ps1

MediumShips Compressed Blobassets/project-control/TeraPricingCalculator.xlsx

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionassets/project-control/TeraPricingCalculator.xlsx

LowNo License