achira-wf@5.2.1
Achira Workflow V5.2.1 — AI-driven development ecosystem with 21 specialist agents and 85 modern engineering & command skills.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected source confirms that postinstall automatically deploys and enables a global agent integration, including a command hook and global instructions, without an affirmative setup action. This meets the policy for blocking unconsented lifecycle mutation of a broad AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm package installation runs the postinstall hook.
Impact
The package gains an active global agent integration and command hook across projects without a separate user-invoked setup action.
Mechanism
The hook invokes the global installer, which writes plugin and agent configuration under the user’s Gemini directory and enables the plugin without a consent check.
Policy narrative
Package installation automatically runs the global installer. It adds agent instructions and skills to the user’s Gemini setup, enables the plugin, and registers a command hook for new projects without a separate consent step. This is an unconsented, install-time change to a broad agent control surface.
AI rationale
The inspected source confirms that postinstall automatically deploys and enables a global agent integration, including a command hook and global instructions, without an affirmative setup action. This meets the policy for blocking unconsented lifecycle mutation of a broad AI-agent control surface.
Evidence
package.jsoncli.jslib/global-manager.js~/.gemini/GEMINI.md~/.gemini/config/config.json~/.gemini/config/plugins/achira-workflow-os/hooks.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The postinstall hook automatically invokes the global install command.
- The global installer writes agent instructions into the plugin directory and the user’s Gemini rules file.
- The installer enables the package’s plugin in global Gemini configuration and registers a command hook for new projects.
- The CLI calls the global installer without a consent check.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli.js global install --silent
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli.js global install --silent
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli.jsView file
75Install-time code directly mutates a foreign AI-agent control surface:
L75:
L76: // 2. Sync .cursorrules for automatic IDE rules
L77: try {
L78: const cursorRulesPath = path.join(target, ".cursorrules");
L79: const geminiRulesPath = path.join(dest, "rules", "GEMINI.md");
...
L82: await fs.ensureSymlink(geminiRulesPath, cursorRulesPath, "file");
L83: console.log(chalk.green(" ✔ Linked .cursorrules → .agent/rules/GEMINI.md\n"));
L84: } catch {
...
L86: await fs.copy(geminiRulesPath, cursorRulesPath);
L87: console.log(chalk.green(" ✔ Synced .cursorrules → .agent/rules/GEMINI.md\n"));
L88: }
...
L90: } catch (err) {
Write operation from lib/global-manager.js:
L214: `;
L215: await fs.writeFile(path.join(paths.pluginTargetDir, "README.md"), pluginReadme, "utf-8");
L216:
...
L268:
L269: //
Findings
1 Critical3 High5 Medium3 Low
CriticalAi Agent Control Hijackcli.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/global-manager.js
HighPayload In Excluded Dir.agent/shared/ui-ux-pro-max/scripts/design_system.py
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helper.agent/shared/ui-ux-pro-max/scripts/design_system.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to achira-wf@5.2.1.
See all versions of achira-wf for other recorded verdicts.
- Avoid installing achira-wf@5.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.