registry / agentools / 2.12.30

agentools@2.12.30

Universal skill, workflow & global rules manager for AI coding assistants with bi-directional GitHub sync

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Confirmed install-time mutation of a foreign AI-agent MCP control surface. The postinstall script silently adds or repairs an enabled Bitwarden MCP server in Antigravity config if the directory exists.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of agentools@2.12.30

Impact

Antigravity may later run a newly configured npx-launched MCP server with Bitwarden-related environment placeholders or repaired settings.

Mechanism

unconsented postinstall AI-agent MCP config mutation

Policy narrative

On npm install, package.json invokes scripts/postinstall.js. That script detects Antigravity via platforms.js and, unless AI_AGENT_NO_AUTOCONFIG is set, writes ~/.gemini/antigravity/mcp_config.json to add or enable a bitwarden MCP server using npx -y @bitwarden/mcp-server. This mutates a broad AI-agent control surface before the user runs an explicit agentools command.

Rationale

The source shows unconsented postinstall mutation of a foreign AI-agent MCP configuration, which matches the block policy even though broader package functionality is aligned with AI-agent config management. No separate exfiltration chain was found, but the install-time control-surface write is concrete. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/postinstall.jsscripts/platforms.js~/.gemini/antigravity/mcp_config.json

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for policy block

package.json runs node scripts/postinstall.js on npm postinstall
scripts/postinstall.js writes Antigravity MCP config during install when ~/.gemini/antigravity exists
postinstall adds/enables bitwarden MCP with command npx and args [-y,@bitwarden/mcp-server]
opt-out requires AI_AGENT_NO_AUTOCONFIG; no explicit install-time consent prompt
scripts/platforms.js identifies Antigravity config path as ~/.gemini/antigravity/mcp_config.json

Evidence against

Main package purpose is AI-agent skill/config management across platforms
Postinstall targets a specific detected platform and preserves existing config keys
No source evidence of credential exfiltration or destructive filesystem behavior in postinstall
CLI installs skills/MCP/rules mostly through explicit user commands
Bitwarden tools list disables many high-risk org/send operations

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 159 KB of source, external domains: github.com, vault.bitwarden.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-30json

2 "name": "agentools",

3 "version": "2.12.30",

4 "description": "Universal skill, workflow & global rules manager for AI coding assistants with bi-directional GitHub sync",

5 "main": "index.js",

6 "bin": {

7 "agentools": "./bin/cli.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node --test",

12 "test:coverage": "npx c8 --all --include='scripts/**/*.js' --check-coverage --lines 90 --functions 90 --branches 80 node --test"

13 },

14 "keywords": [

15 "ai",

16 "agent",

17 "skills",

18 "claude-code",

19 "antigravity",

20 "antigravity-cli",

21 "cursor",

22 "windsurf",

23 "copilot",

24 "workflows",

25 "coding-assistant",

26 "global-skills",

27 "custom-skills",

28 "skill-manager"

29 ],

30 "author": "Dong Tran",

scripts/secret-manager.jsView file

Lines 1-27javascript

1/**

2 * Secret Manager Module

3 * Manages MCP secrets using Bitwarden integration

4 */

6const fs = require("fs");

7const path = require("path");

8const { execSync, spawnSync } = require("child_process");

9const os = require("os");

11const HOME = os.homedir();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/secret-manager.jsView on unpkg · L7

13/**

14 * Validate that Bitwarden CLI is installed

15 */

16function validateBitwardenCLI() {

17 try {

18 execSync("which bw", { stdio: "pipe" });

19 return { valid: true };

20 } catch (error) {

21 return {

22 valid: false,

23 message: "Bitwarden CLI not found. Install with: npm install -g @bitwarden/cli",

24 };

25 }

26}

scripts/postinstall.jsView file

Lines 9-49javascript

10// Bitwarden MCP: Tools to disable (org management, device approval, sends, etc.)

11const BITWARDEN_DISABLED_TOOLS = [

12 "lock", "sync", "status", "confirm",

13 "create_org_collection", "edit_org_collection", "edit_item_collections", "move",

14 "device_approval_list", "device_approval_approve", "device_approval_approve_all",

15 "device_approval_deny", "device_approval_deny_all",

16 "create_text_send", "create_file_send", "list_send", "get_send",

17 "edit_send", "delete_send", "remove_send_password",

18 "create_attachment",

19 "list_org_collections", "get_org_collection", "update_org_collection", "delete_org_collection",

20 "list_org_members", "get_org_member", "get_org_member_groups",

21 "invite_org_member", "update_org_member", "update_org_member_groups",

22 "remove_org_member", "reinvite_org_member",

23 "list_org_groups", "get_org_group", "get_org_group_members",

24 "create_org_group", "update_org_group", "delete_org_group", "update_org_group_members",

25 "list_org_policies", "get_org_policy", "update_org_policy",

26 "get_org_events", "get_org_subscription", "update_org_subscription",

27 "import_org_users_and_groups"

28];

30function main() {

31 console.log("\n╔═══════════════════════════════════════════════════════════════╗");

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L29

32 console.log("║ AI Agent Config Installed! ║");

33 console.log("╚═══════════════════════════════════════════════════════════════╝\n");

35 // Detect platforms

36 const detected = platforms.detectAll();

38 if (detected.length > 0) {

39 console.log("🔍 Detected platforms:\n");

40 detected.forEach((p) => {

41 console.log(` ✓ ${p.displayName}`);

42 });

43 console.log("");

44 }

46 console.log("📦 Bundled Skills:\n");

47 console.log(" • config-manager - Manage configuration and sources");

48 console.log(" • skill-updater - Update skills from repositories\n");

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/secret-manager.jsView file

7const path = require("path"); L8: const { execSync, spawnSync } = require("child_process"); L9: const os = require("os"); L10: L11: const HOME = os.homedir(); L12: ... L36: }); L37: const output = result.stdout || ""; L38: const json = JSON.parse(output.trim()); L39: return json.status; // "unauthenticated", "locked", "unlocked" ... L48: function loginBitwarden() { L49: const clientId = process.env.BW_CLIENTID;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/secret-manager.jsView on unpkg · L7

scripts/postinstall.jsView file

29Install-time AI-agent control hijack evidence: L79: try { L80: let mcpConfig = { mcpServers: {} }; L81: ... L91: let changed = false; L92: if (!mcpConfig.mcpServers.bitwarden) { L93: mcpConfig.mcpServers.bitwarden = { L94: command: "npx", ... L106: // Ensure correct env var names even if already exists L107: const bw = mcpConfig.mcpServers.bitwarden; L108: if (!bw.env.BW_SESSION || !bw.env.BW_CLIENT_ID || !bw.env.BW_CLIENT_SECRET || bw.disabled) { ... L127: if (changed) { L128: fs.writeFileSync( Payload evidence from scripts/mcp-installer.js: L29: L30: const expanded = repoLocal.replace(/^~/, process.env.HOME || process.env.USERPROFILE); L31: const mcpDir = path.join(expanded, ".agents", "mcp-servers"); ... L80: try { L81: const config = JSON.parse(fs.readFileSync(configPath, "utf-8")); L82: const validation = validateMcpConfig(config); ... L155: // Only on Unix-like systems (macOS, Linux) - Windows uses ACL instead L156: if (process.platform !== "win32") { L157: try {

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L29

Findings

1 Critical1 High4 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumInstall Persistencescripts/secret-manager.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-30json

2 "name": "agentools",

3 "version": "2.12.30",

4 "description": "Universal skill, workflow & global rules manager for AI coding assistants with bi-directional GitHub sync",

5 "main": "index.js",

6 "bin": {

7 "agentools": "./bin/cli.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node --test",

12 "test:coverage": "npx c8 --all --include='scripts/**/*.js' --check-coverage --lines 90 --functions 90 --branches 80 node --test"

13 },

14 "keywords": [

15 "ai",

16 "agent",

17 "skills",

18 "claude-code",

19 "antigravity",

20 "antigravity-cli",

21 "cursor",

22 "windsurf",

23 "copilot",

24 "workflows",

25 "coding-assistant",

26 "global-skills",

27 "custom-skills",

28 "skill-manager"

29 ],

30 "author": "Dong Tran",

scripts/secret-manager.jsView file

Lines 1-27javascript

1/**

2 * Secret Manager Module

3 * Manages MCP secrets using Bitwarden integration

4 */

6const fs = require("fs");

7const path = require("path");

8const { execSync, spawnSync } = require("child_process");

9const os = require("os");

11const HOME = os.homedir();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/secret-manager.jsView on unpkg · L7

13/**

14 * Validate that Bitwarden CLI is installed

15 */

16function validateBitwardenCLI() {

17 try {

18 execSync("which bw", { stdio: "pipe" });

19 return { valid: true };

20 } catch (error) {

21 return {

22 valid: false,

23 message: "Bitwarden CLI not found. Install with: npm install -g @bitwarden/cli",

24 };

25 }

26}

scripts/postinstall.jsView file

Lines 9-49javascript

10// Bitwarden MCP: Tools to disable (org management, device approval, sends, etc.)

11const BITWARDEN_DISABLED_TOOLS = [

12 "lock", "sync", "status", "confirm",

13 "create_org_collection", "edit_org_collection", "edit_item_collections", "move",

14 "device_approval_list", "device_approval_approve", "device_approval_approve_all",

15 "device_approval_deny", "device_approval_deny_all",

16 "create_text_send", "create_file_send", "list_send", "get_send",

17 "edit_send", "delete_send", "remove_send_password",

18 "create_attachment",

19 "list_org_collections", "get_org_collection", "update_org_collection", "delete_org_collection",

20 "list_org_members", "get_org_member", "get_org_member_groups",

21 "invite_org_member", "update_org_member", "update_org_member_groups",

22 "remove_org_member", "reinvite_org_member",

23 "list_org_groups", "get_org_group", "get_org_group_members",

24 "create_org_group", "update_org_group", "delete_org_group", "update_org_group_members",

25 "list_org_policies", "get_org_policy", "update_org_policy",

26 "get_org_events", "get_org_subscription", "update_org_subscription",

27 "import_org_users_and_groups"

28];

30function main() {

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L29

32 console.log("║ AI Agent Config Installed! ║");

35 // Detect platforms

36 const detected = platforms.detectAll();

38 if (detected.length > 0) {

39 console.log("🔍 Detected platforms:\n");

40 detected.forEach((p) => {

41 console.log(` ✓ ${p.displayName}`);

42 });

43 console.log("");

44 }

46 console.log("📦 Bundled Skills:\n");

47 console.log(" • config-manager - Manage configuration and sources");

48 console.log(" • skill-updater - Update skills from repositories\n");