@tonyclaw/agent-inspector@4.0.30: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@tonyclaw/agent-inspector@4.0.30: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup-agent-skills.mjsView file

3import { dirname, join } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

scripts/setup-agent-skills.mjsView on unpkg · L3

.output/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tonyclaw/agent-inspector@4.0.29 matchedIdentity = npm:[redacted]:4.0.29 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

.output/cli.jsView on unpkg

65L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function Qp(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Ia($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

.output/cli.jsView on unpkg · L65

63L64: `)}v.write("payload.value = newResult;"),v.write("return payload;");let q=v.compile();return(Z,R)=>q(f,Z,R)},i,a=Ut,s=!zt.jitless,l=s&&bs.value,d=t.catchall,p;e._zod.parse=(f,v)=>{... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function Qp(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Ia($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...

Source & flagged code

7 flagged

package.jsonView file

Lines 88-128json

88 "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",

89 "compatibility:run": "node scripts/compatibility/cli.mjs run",

90 "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",

91 "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",

92 "build:cli": "npx esbuild src/cli.ts --bundle --minify --legal-comments=none --platform=node --target=node22 --format=esm --outfile=.output/cli.js",

93 "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --minify --legal-comments=none --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",

94 "rust:build-package": "node scripts/rust/build-platform.mjs",

95 "rust:stage-package": "node scripts/rust/stage-platform.mjs",

96 "rust:verify-package": "node scripts/rust/verify-platform.mjs",

97 "rust:pack-package": "node scripts/rust/pack-platform.mjs",

98 "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",

99 "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",

100 "rust:release-gate:preflight": "node scripts/rust/release-gate-preflight.mjs",

101 "rust:release-evidence:plan": "node scripts/rust/release-evidence-plan.mjs",

102 "commercial:release-gate:preflight": "node scripts/commercial-release-preflight.mjs",

103 "test:commercial-release-gate": "bun test scripts/commercialReleasePreflight.test.ts",

104 "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/rust/releaseGatePreflight.test.ts scripts/releaseCore.test.ts",

105 "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",

106 "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",

107 "themes:generate": "node scripts/generate-theme-scales.mjs",

108 "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L108

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L108

109 "prepublishOnly": "node scripts/rust/require-release-orchestrator.mjs",

110 "typecheck": "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",

111 "lint": "eslint . --cache --cache-location .cache/eslintcache",

112 "format": "biome format --write .",

113 "format:check": "biome format .",

114 "verify:ultra": "node scripts/compatibility/ultra-gate.mjs",

115 "verify:ultra:fresh": "node scripts/compatibility/ultra-gate.mjs --no-cache",

116 "verify:ultra:smoke": "npm run verify:ultra && npm run test:smoke",

117 "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",

118 "extension:zip": "node scripts/pack-chrome-extension.mjs",

119 "extension:release": "node scripts/release-chrome-extension.mjs",

120 "release": "node scripts/release.mjs",

121 "knip": "knip",

122 "check": "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun check:commercial-performance && bun check:hostile-inputs && bun compatibility:bdd && bun rust:packages:check",

123 "prepare": "husky",

124 "ladle": "ladle serve",

125 "ladle:build": "ladle build"

126 },

127 "dependencies": {

128 "@mariozechner/pi-agent-core": "^0.73.1",

scripts/setup-agent-skills.mjsView file

Lines 1-23javascript

1import { existsSync } from "node:fs";

2import { homedir } from "node:os";

3import { dirname, join } from "node:path";

4import { spawnSync } from "node:child_process"

.output/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tonyclaw/agent-inspector@4.0.29 matchedIdentity = npm:[redacted]:4.0.29 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

.output/cli.jsView on unpkg

65L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function Qp(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Ia($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

.output/cli.jsView on unpkg · L65

63L64: `)}v.write("payload.value = newResult;"),v.write("return payload;");let q=v.compile();return(Z,R)=>q(f,Z,R)},i,a=Ut,s=!zt.jitless,l=s&&bs.value,d=t.catchall,p;e._zod.parse=(f,v)=>{... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function Qp(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Ia($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...