Loading npm security reports…

agent-orchestration-workflow@0.3.1: AI-agent control-surface risk | LPM Firewall

registry / agent-orchestration-workflow / 0.3.1

agent-orchestration-workflow@0.3.1

Global Codex skill plus TUI/GUI control room and token-aware orchestration CLI for Codex subagents.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically places a bundled skill in the user's global Codex configuration. This alters future AI-agent behavior outside the consuming project.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, which runs postinstall automatically.

Impact

An unprompted package install can persist package-controlled instructions and executables in the user's AI-agent skill directory.

Mechanism

Global Codex skill installation and replacement.

Policy narrative

The package declares a postinstall lifecycle hook. On installation, it resolves the user's home directory, creates the global Codex skills directory, backs up any existing skill, and copies its bundled agent-orchestration skill there. This is an unconsented mutation of a broad AI-agent control surface and persists beyond the consuming project.

AI rationale

The package's automatic postinstall writes a package-controlled skill into the user's global Codex configuration. Although no exfiltration or network payload was found, this concrete install-time control-surface mutation meets the blocking policy.

Evidence

package.jsontools/install-codex-skill.mjs$HOME/.codex/skills/agent-orchestration-skill$HOME/.codex/skills/.aow-backup-*

Decision evidence

public snapshot

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node tools/install-codex-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

tools/install-codex-skill.mjsView file

1#!/usr/bin/env node L2: import { chmodSync, cpSync, existsSync, mkdirSync, renameSync, statSync } from 'node:fs'; L3: import { dirname, join, resolve } from 'node:path'; ... L45: } L46: mkdirSync(backupRoot, { recursive: true }); L47: renameSync(path, join(backupRoot, name)); ... L53: } L54: const codexHome = join(homeDir(), '.codex'); L55: const skillsDir = join(codexHome, 'skills'); L56: const dst = join(skillsDir, SKILL_NAME); L57: mkdirSync(skillsDir, { recursive: true }); L58:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

tools/install-codex-skill.mjsView on unpkg · L1

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: url); const __dirname = dirname(__filename); const pkg_root = resolve(__dirname, '..'); const skill_name = 'agent-orchestration-skill'; const skill_src = join(pkg_root, 'skills', skill_name); const quiet = process.argv.includes('--quiet') || process.env.aow_postinstall_quiet === '1'; const strict = process.argv.includes('--strict') || process.env.aow_postinstall_strict === '1'; function log(message) { if (!quiet) console.log(message); } function warn(message) { if (!quiet) console.warn(message); } function isdirectory(path) { try { return statsync(path).isdirectory(); } catch { return false; } } function homedir() { const home = process.env.home || process.env.userprofile || '

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

tools/install-codex-skill.mjsView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 9843 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/workflow_v2_validation.pyView file

•path = tests/workflow_v2_validation.py kind = payload_in_excluded_dir sizeBytes = 109180 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/workflow_v2_validation.pyView on unpkg

bin/aow.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/aow.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "agent-orchestration-workflow",

3 "version": "0.3.1",

4 "private": false,

5 "description": "Global Codex skill plus TUI/GUI control room and token-aware orchestration CLI for Codex subagents.",

6 "license": "MIT",

7 "type": "module",

8 "bin": {

9 "aow": "./bin/aow.mjs"

10 },

11 "scripts": {

12 "fix:permissions": "node tools/fix-permissions.mjs",

13 "test": "node tools/fix-permissions.mjs --quiet && PYTHONDONTWRITEBYTECODE=1 python3 tests/workflow_v2_validation.py && PYTHONDONTWRITEBYTECODE=1 python3 tests/aggressive_validation.py",

14 "test:v2": "PYTHONDONTWRITEBYTECODE=1 python3 tests/workflow_v2_validation.py",

15 "test:npm-cli": "node tools/fix-permissions.mjs --quiet && PYTHONDONTWRITEBYTECODE=1 node tests/aow_03_validation.mjs && PYTHONDONTWRITEBYTECODE=1 node tests/npm_cli_validation.mjs",

16 "pack:dry": "npm pack --dry-run",

17 "doctor": "npm run publish:check",

18 "publish:check": "node tools/fix-permissions.mjs --quiet && node bin/aow.mjs publish-check --pack-dry-run",

19 "validate:production": "node tools/fix-permissions.mjs --quiet && npm test && npm run test:npm-cli && npm run publish:check && npm pack --dry-run",

20 "postinstall": "node tools/install-codex-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "prepublishOnly": "npm run validate:production"

22 },

23 "files": [

24 "bin/",

25 "tools/",

26 "skills/",

27 "subagents/",

28 "docs/",

29 "AGENTS.md",

30 "install.sh",

31 "README.md",

32 "SKILL_PACK_MANIFEST.json",

33 "tests/",

34 "LICENSE",

35 "!**/__pycache__/",

36 "!**/__pycache__/**",

37 "!**/*.pyc",

38 "!**/*.pyo"

39 ],

40 "engines": {

tools/install-codex-skill.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { chmodSync, cpSync, existsSync, mkdirSync, renameSync, statSync } from 'node:fs';

3import { dirname, join, resolve } from 'node:path';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

tools/install-codex-skill.mjsView on unpkg · L1

4import { fileURLToPath } from

install.shView file

•path = install.sh kind = build_helper sizeBytes = 9843 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/workflow_v2_validation.pyView file

•path = tests/workflow_v2_validation.py kind = payload_in_excluded_dir sizeBytes = 109180 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/workflow_v2_validation.pyView on unpkg

bin/aow.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/aow.mjs#virtual:normalized:round1View on unpkg