registry / @theronap/agnoclast-mcp / 0.9.206
@theronap/agnoclast-mcp@0.9.206
Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected code supports a warning for first-party agent configuration and skill setup that can persist beyond the initial CLI action. The package manifest has no install lifecycle hook, and the available source does not establish an attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the package's setup command; the manifest shows no npm install lifecycle trigger.
Impact
This can add package-owned assistant behavior after explicit setup; no concrete malicious behavior was identified.
Mechanism
Setup writes assistant configuration, and the skills module targets Claude and Codex skill directories. The inspected source does not establish an unconsented install-time mutation.
AI rationale
The inspected code supports a warning for first-party agent configuration and skill setup that can persist beyond the initial CLI action. The package manifest has no install lifecycle hook, and the available source does not establish an attack.
Evidence
lib/setup.mjslib/skills.mjs
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes an explicit CLI and declares no npm lifecycle hooks.
- Setup writes assistant configuration after parsing a user-supplied token.
- The skills module targets Claude and Codex skill directories; setup can install package-owned skills there.
- Uninstall targets the package's assistant configuration files for removal.
- Codex and Cursor adapters describe limited hook capabilities; the inspected code does not establish a covert configuration change.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The inspected Antigravity adapter describes generated setup artifacts and a portability limitation; it does not establish an active attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedlib/capture.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @theronap/agnoclast-mcp@0.9.150
matchedIdentity = npm:QHRoZXJvbmFwL2Fnbm9jbGFzdC1tY3A:0.9.150
similarity = 0.739
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/capture.mjsView on unpkg1import { readFileSync, accessSync, constants, openSync, mkdirSync } from 'fs'
L2: import { spawn, execFileSync } from 'child_process'
L3: import { homedir } from 'os'
...
L21: if (!res.ok) return null
L22: const j = await res.json().catch(() => ({}))
L23: return Array.isArray(j.types) ? j.types : null
...
L35: try {
L36: if (resolve(String(cwd)) === homedir()) return 'general'
L37: } catch { /* unresolvable path — fall through to basename */ }
...
L45: //
L46: // Handles the four remote forms git emits: scp-like ssh (git@github.com:o/n.git), ssh://, https://,
L47: // git://. The HOST CHECK IS LOAD-BEARING, not cosmetic: this string becomes a clearance key, and
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/capture.mjsView on unpkg · L1lib/editors/antigravity.mjs
Findings
4 High3 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/uninstall.mjs
HighTrigger Reachable Persistencelib/editors/antigravity.mjs
HighSemantic Analysis Limitedbin/cortex-mcp.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/capture.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/editors/antigravity.mjs
LowScripts Present
LowWeak Cryptolib/capture.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @theronap/agnoclast-mcp@0.9.206.
See all versions of @theronap/agnoclast-mcp for other recorded verdicts.
- Review the evidence and your use of @theronap/agnoclast-mcp@0.9.206 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.