registry / @tonyclaw/agent-inspector / 4.0.34

@tonyclaw/agent-inspector@4.0.34

Agent observability and knowledge capture layer for AI coding tools.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The postinstall hook can install this package’s generated onboarding skills into detected Claude or Codex user directories. This is a guarded first-party agent integration; no separate attack behavior was established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing the package when a Claude or Codex home directory exists, unless the corresponding opt-out variable is set.

Impact

Agent environments may gain the package’s onboarding skill files.

Mechanism

The hook invokes the local onboarding CLI, which writes generated files to selected integration paths.

AI rationale

The source confirms automatic, guarded setup of this package’s own agent onboarding skills during postinstall. Under the agent integration policy, this warrants a warning; inspected evidence does not support a malicious block.

Evidence

package.jsonscripts/setup-agent-skills.mjs.output/cli.js.output/server/_ssr/router-CmCqYsYf.mjs

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall lifecycle automatically runs the Windows runtime setup and agent-skill setup scripts.
The setup script proceeds when Claude or Codex home directories exist, unless an opt-out variable is set.
The onboarding command writes selected generated files to target paths; this is first-party skill setup.
The server bundle identifies Claude and Codex skill and agent directories as integration targets.

Evidence against

The inspected setup path installs onboarding files and does not show credential collection or network transmission.
The onboarding write loop writes generated file bodies to selected paths; no destructive or remote-execution behavior is shown in the excerpt.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 5.40 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 88-128json

88 "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",

89 "compatibility:run": "node scripts/compatibility/cli.mjs run",

90 "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",

91 "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",

92 "build:cli": "npx esbuild src/cli.ts --bundle --minify --legal-comments=none --platform=node --target=node22 --format=esm --outfile=.output/cli.js",

93 "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --minify --legal-comments=none --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",

94 "rust:build-package": "node scripts/rust/build-platform.mjs",

95 "rust:stage-package": "node scripts/rust/stage-platform.mjs",

96 "rust:verify-package": "node scripts/rust/verify-platform.mjs",

97 "rust:pack-package": "node scripts/rust/pack-platform.mjs",

98 "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",

99 "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",

100 "rust:release-gate:preflight": "node scripts/rust/release-gate-preflight.mjs",

101 "rust:release-evidence:plan": "node scripts/rust/release-evidence-plan.mjs",

102 "commercial:release-gate:preflight": "node scripts/commercial-release-preflight.mjs",

103 "test:commercial-release-gate": "bun test scripts/commercialReleasePreflight.test.ts",

104 "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/rust/releaseGatePreflight.test.ts scripts/releaseCore.test.ts",

105 "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",

106 "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",

107 "themes:generate": "node scripts/generate-theme-scales.mjs",

108 "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L108

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L108

109 "prepublishOnly": "node scripts/rust/require-release-orchestrator.mjs",

Medium

Suspicious Lifecycle Evidence

The postinstall lifecycle automatically runs the Windows runtime setup and agent-skill setup scripts.

package.jsonView on unpkg · L108

110 "typecheck": "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",

111 "lint": "eslint . --cache --cache-location .cache/eslintcache",

112 "format": "biome format --write .",

113 "format:check": "biome format .",

114 "verify:ultra": "node scripts/compatibility/ultra-gate.mjs",

115 "verify:ultra:fresh": "node scripts/compatibility/ultra-gate.mjs --no-cache",

116 "verify:ultra:smoke": "npm run verify:ultra && npm run test:smoke",

117 "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",

118 "extension:zip": "node scripts/pack-chrome-extension.mjs",

119 "extension:release": "node scripts/release-chrome-extension.mjs",

120 "release": "node scripts/release.mjs",

121 "knip": "knip",

122 "check": "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun check:commercial-performance && bun check:hostile-inputs && bun compatibility:bdd && bun rust:packages:check",

123 "prepare": "husky",

124 "ladle": "ladle serve",

125 "ladle:build": "ladle build"

126 },

127 "dependencies": {

128 "@mariozechner/pi-agent-core": "^0.73.1",

scripts/setup-agent-skills.mjsView file

Lines 1-23javascript

1import { existsSync } from "node:fs";

2import { homedir } from "node:os";

3import { dirname, join } from "node:path";

4import { spawnSync } from "node:child_process"

.output/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tonyclaw/agent-inspector@4.0.32 matchedIdentity = npm:[redacted]:4.0.32 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

.output/cli.jsView on unpkg

65L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function rm(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Pa($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

.output/cli.jsView on unpkg · L65

63L64: `)}v.write("payload.value = newResult;"),v.write("return payload;");let M=v.compile();return(H,w)=>M(f,H,w)},i,a=jt,s=!Dt.jitless,l=s&&xs.value,d=t.catchall,p;e._zod.parse=(f,v)=>{... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function rm(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Pa($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

108"postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs", "prepublishOnly": "n

Medium

Suspicious Lifecycle Evidence

The postinstall lifecycle automatically runs the Windows runtime setup and agent-skill setup scripts.

package.jsonView on unpkg · L108

scripts/setup-agent-skills.mjsView file

3import { dirname, join } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

scripts/setup-agent-skills.mjsView on unpkg · L3

.output/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

.output/cli.jsView on unpkg

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

.output/cli.jsView on unpkg · L65

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

.output/cli.jsView on unpkg · L63

63Trigger-reachable command-output exfiltration chain: scripts.start -> .output/cli.js L63: L64: `)}v.write("payload.value = newResult;"),v.write("return payload;");let M=v.compile();return(H,w)=>M(f,H,w)},i,a=jt,s=!Dt.jitless,l=s&&xs.value,d=t.catchall,p;e._zod.parse=(f,v)=>{... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(t===a[0]){i(a);continue}if(e.external){let l=e.exter... L67: `))}catch{return[]}}function rm(e,t=process.platform){if(!Number.isInteger(e)||e<=0)return!1;try{if(t==="win32")try{return Pa($b("taskkill.exe"),["/PID",String(e),"/T","/F"],{encod...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

.output/cli.jsView on unpkg · L63

Findings

1 Critical5 High3 Medium3 Low

CriticalPrevious Version Dangerous Delta.output/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/setup-agent-skills.mjs

HighSame File Env Network Execution.output/cli.js

HighCommand Output Exfiltration.output/cli.js

HighTrigger Reachable Command Output Exfiltration.output/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @tonyclaw/agent-inspector@4.0.34.

See version security history for other recorded verdicts.

Review the evidence and your use of @tonyclaw/agent-inspector@4.0.34 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 18:57:34.353Z (UTC).