registry / agile-sddf / 2.0.1

agile-sddf@2.0.1

Agile Spec-Driven-Development Framework for AI agents

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically writes bundled agent skills into consumer AI-agent control directories. The default target is the consumer project's .claude directory.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes postinstall.

Impact

A dependency installation can alter the instructions and capabilities available to AI tooling in the consumer project.

Mechanism

Automatic copying of skills and agents into AI-agent directories.

Policy narrative

The package declares a postinstall hook that calls its installer with .claude as the default target. The installer resolves the consumer project directory and copies its bundled skills and agents into .claude, with alternate .agents and .github targets and overwrite support. This changes a foreign AI-agent control surface during dependency installation without an explicit user command.

Rationale

This is unconsented postinstall mutation of broad AI-agent control surfaces in the consumer project. No separate network or credential-theft behavior is required to establish the install-time control-surface risk.

Evidence

package.jsonscripts/postinstall.jsscripts/install.js.claude/skills.claude/agents.agents/skills.agents/agents.github/skills.github/agents

agile-sddf@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code