agent-cards@0.8.0
CLI for managing virtual debit cards for AI agents
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious install-hook abuse because package installation has no install lifecycle script. Its explicit agent-control mutation and automatic self-update remain meaningful supply-chain risk, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running agents add, invoking a normal CLI command when an update is available, or running api skill install.
Impact
A user-authorized command can steer supported coding agents toward this vendor's CLI; later releases can change the CLI through automatic global updates.
Mechanism
AI-agent instruction rewriting, global self-update, and remote skill installation.
AI rationale
This is not malicious install-hook abuse because package installation has no install lifecycle script. Its explicit agent-control mutation and automatic self-update remain meaningful supply-chain risk, so a warning is appropriate.
Evidence
dist/src/commands/agents.jsdist/src/lib/global-install.jsdist/src/lib/update.jsdist/src/commands/api.jsdist/bin/agent-cards.js.claude/CLAUDE.md.codex/AGENTS.md.gemini/GEMINI.md.agents/skills/<skill>/SKILL.md
Network endpoints2
registry.npmjs.org/agent-cards/latestwww.agentcard.sh/.well-known/agent-skills/index.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit agents add command writes steering text to Claude, Codex, and Gemini instruction files.
- Flag-driven agents add can install the package globally without a separate confirmation.
- Normal CLI commands check for updates and can replace the global installation with the latest registry release.
- The explicit skill-install command downloads remote content and writes it into the current project's agent skills directory.
Evidence against
- package.json has only prepublishOnly, so package installation does not run a lifecycle hook.
- Agent instruction changes are exposed as an explicit CLI command; automatic refresh only updates files already carrying this package's markers.
- No source evidence of credential harvesting, secret exfiltration, or an unconsented install-time control-surface mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/src/lib/update.jsView file
2import { join, dirname } from 'path';
L3: import { execSync, spawnSync, execFileSync } from 'child_process';
L4: import { CONFIG_DIR } from './config.js';
High
Child Process
Package source references child process execution.
dist/src/lib/update.jsView on unpkg · L2dist/src/commands/api.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = agent-cards@0.7.3
matchedIdentity = npm:YWdlbnQtY2FyZHM:0.7.3
similarity = 0.608
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/commands/api.jsView on unpkg22if (existsSync(p)) {
L23: return (await import(pathToFileURL(p).href));
L24: }
Findings
1 Critical5 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/src/commands/api.js
HighChild Processdist/src/lib/update.js
HighShell
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/agents.js
HighRuntime Package Installdist/src/lib/global-install.js
HighSemantic Analysis Limiteddist/src/commands/api.js#virtual:normalized:round1
MediumDynamic Requiredist/src/commands/api.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to agent-cards@0.8.0.
See all versions of agent-cards for other recorded verdicts.
- Review the evidence and your use of agent-cards@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.