registry / amicus / 1.7.7

amicus@1.7.7

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Install-time script mutates Claude/AI-agent control surfaces by installing package-supplied skills and registering MCP servers. This gives the package persistent invocation paths in future AI-agent sessions without an explicit runtime command from the user.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall

Impact

Future Claude/AI-agent sessions may load package instructions and invoke amicus MCP/CLI tools, including spawning model sidecars with inherited environment and workspace context.

Mechanism

unconsented lifecycle AI-agent skill and MCP registration

Attack narrative

On installation, the lifecycle script copies package-authored Claude skills into the user's global Claude skills directory and registers amicus/sidecar MCP entries for Claude Code and Claude Desktop. Those entries run npx -y amicus@latest mcp, creating a persistent AI-agent integration path beyond normal package import or CLI use.

Rationale

The confirmed issue is not generic network or credential handling; it is install-time mutation of Claude skills and MCP configuration, an AI-agent control surface. Under the firewall boundary, unconsented lifecycle registration of agent instructions/tools is blocking behavior even if the package's stated purpose is AI sidecars. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/postinstall.jsskills/sidecar/SKILL.mdskills/second-opinion/SKILL.mdsrc/mcp-server.jssrc/utils/env-loader.jssrc/utils/auth-json.js~/.claude/skills/sidecar/SKILL.md~/.claude/skills/second-opinion/SKILL.md~/.claude/skills/second-opinion/COUNCIL-DESIGN.md~/.claude/skills/second-opinion/MODEL-NOTES.md~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%/Claude/claude_desktop_config.json~/.config/claude/claude_desktop_config.json

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

package.json defines postinstall: node scripts/postinstall.js.
scripts/postinstall.js copies package skills into ~/.claude/skills/sidecar and ~/.claude/skills/second-opinion.
scripts/postinstall.js registers MCP servers in Claude Code/Desktop configs, including fallback writes to ~/.claude.json and claude_desktop_config.json.
MCP config uses command npx with args ['-y','amicus@latest','mcp'], causing future agent sessions to invoke this package.
skills/sidecar/SKILL.md contains agent-triggering instructions to spawn amicus commands and use Build mode with full tool access.

Evidence against

Postinstall is visible in package.json, best-effort, and can be skipped with AMICUS_SKIP_POSTINSTALL=1.
Network/API code appears aligned with an LLM sidecar tool rather than credential exfiltration.
Credential loader reads known provider keys into process.env for model access and does not show outbound exfiltration by itself.
MCP server constrains explicit project roots before spawning sidecar sessions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 124 file(s), 760 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.deepseek.com, api.openai.com, console.anthropic.com, generativelanguage.googleapis.com, nodejs.org, openrouter.ai, platform.deepseek.com, platform.openai.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 36-76json

36 "./opencode-client": "./src/opencode-client.mjs"

37 },

38 "files": [

39 "bin/",

40 "src/",

41 "electron/",

42 "skills/",

43 ".claude-plugin/",

44 "CHANGELOG.md",

45 "scripts/postinstall.js",

46 "scripts/setup-hooks.js"

47 ],

48 "scripts": {

49 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

50 "test": "jest",

51 "test:integration": "jest --testPathIgnorePatterns='\\.worktrees/' --testMatch='**/tests/**/*.integration.test.js'",

52 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='\\.worktrees/' && node scripts/mark-test-passed.js",

53 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

54 "posttest": "node scripts/mark-test-passed.js",

55 "lint": "eslint src/",

56 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "test:thinking": "node scripts/benchmark-thinking.js",

58 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

59 "refresh-models": "node bin/amicus.js models --refresh",

60 "models:info": "node bin/amicus.js models",

61 "models:check": "node bin/amicus.js models --check",

62 "generate-icon": "node scripts/generate-icon.js",

63 "generate-docs": "node scripts/generate-docs.js",

64 "generate-docs:check": "node scripts/generate-docs.js --check",

65 "validate-docs": "node scripts/validate-docs.js --full",

66 "setup-hooks": "node scripts/setup-hooks.js",

67 "check:secrets": "node scripts/check-secrets.js --all",

68 "check:sizes": "node scripts/check-file-sizes.js --all",

69 "check:tarball": "node scripts/check-tarball-lifecycle.js"

70 },

71 "dependencies": {

72 "@modelcontextprotocol/sdk": "^1.27.0",

73 "@opencode-ai/sdk": "^1.1.36",

74 "dotenv": "^17.2.3",

75 "opencode-ai": "^1.2.20",

76 "tiktoken": "^1.0.0",

bin/amicus.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

10// One-time, non-destructive migration of the legacy ~/.config/sidecar dir onto

11// the canonical ~/.config/amicus (copy; legacy kept as a backup). Runs before

12// any config/credential read so both resolve to the unified dir. Best-effort.

13try {

14 const { migrateLegacyConfigDir } = require('../src/utils/config');

15 const _m = migrateLegacyConfigDir();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L13

16 if (_m && _m.migrated) {

17 process.stderr.write(`[amicus] Migrated config ${_m.from} → ${_m.to} (legacy kept as a backup).\n`);

18 }

19} catch { /* best-effort: never block startup on migration */ }

21// Load API keys from all sources: process.env > sidecar .env > auth.json

22const { loadCredentials } = require('../src/utils/env-loader');

23loadCredentials();

25const { parseArgs, getUsage } = require('../src/cli');

26const { validateTaskId } = require('../src/utils/validators');

27const { resolveModelFromArgs, validateFallbackModel } = require('../src/utils/start-helpers');

28const { handleSetup, handleAbort, handleUpdate, handleMcp, handleKey } = require('../src/cli-handlers');

29const { handleStart, handleFanout, handleRead } = require('../src/cli-handlers-run');

30const { isOneShotCommand, armExitWatchdog } = require('../src/utils/lifecycle');

31const { logger } = require('../src/utils/logger');

33const VERSION = require('../package.json').version;

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3/**

4 * Post-install script for amicus

5 *

6 * 1. Copies SKILL.md to ~/.claude/skills/sidecar/

7 * 2. Registers MCP server in Claude Code (~/.claude.json)

8 * 3. Registers MCP server in Claude Desktop/Cowork config

9 */

11const fs = require('fs');

12const path = require('path');

13const os = require('os');

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

14const { execFileSync } = require('child_process');

16const { repairElectron } = require('../src/sidecar/electron-install');

17const HINTS = require('../src/utils/remediation-hints');

19const SETUP_HOOKS_SCRIPT = path.join(__dirname, 'setup-hooks.js');

21/** Short cache-only provision budget: a slow disk must never hang the install. */

22const PROVISION_TIMEOUT_MS = 15000;

24const SKILL_SOURCE = path.join(__dirname, '..', 'skills', 'sidecar', 'SKILL.md');

25const COUNCIL_SOURCE_DIR = path.join(__dirname, '..', 'skills', 'second-opinion');

src/mcp-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = amicus@1.8.1 matchedIdentity = npm:YW1pY3Vz:1.8.1 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mcp-server.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

13try { L14: const { migrateLegacyConfigDir } = require('../src/utils/config'); L15: const _m = migrateLegacyConfigDir();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L13

scripts/postinstall.jsView file

5Install-time AI-agent control hijack evidence: L5: * L6: * 1. Copies SKILL.md to ~/.claude/skills/sidecar/ L7: * 2. Registers MCP server in Claude Code (~/.claude.json) L8: * 3. Registers MCP server in Claude Desktop/Cowork config ... L36: function skillsRoot() { L37: return path.join(os.homedir(), '.claude', 'skills'); L38: } ... L58: L59: if (!existing.mcpServers) { existing.mcpServers = {}; } L60: L61: const prev = existing.mcpServers[name]; L62: const status = !prev ? 'added' : JSON.stringify(prev) !== JSON.stringify(config) ? 'updated' : 'unchanged'; Payload evidence from skills/sidecar/SKILL.md: L11: run_in_background: true. Never run amicus start/resume/continue in the foreground. L12: (2) The fold summary returns on stdout when the user clicks Fold in the GUI or the L13: headless agent finishes. Use TaskOutput to read it when the background task completes. ... L69: **Step 1: Get an OpenRouter API key** L70: - Sign up at https://openrouter.ai L71: - Go to Keys → Create Key ... L78: mkdir -p ~/.local/share/opencode L79: cat > ~/.local/share/opencode/auth.json << 'EOF' L80: { ... L119: L120: Add these to your shell profile (`~/.bashrc`, `~/.zshrc`) for persistence. L121:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

src/mcp-server.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mcp-server.jsView on unpkg

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltasrc/mcp-server.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/amicus.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 36-76json

36 "./opencode-client": "./src/opencode-client.mjs"

37 },

38 "files": [

39 "bin/",

40 "src/",

41 "electron/",

42 "skills/",

43 ".claude-plugin/",

44 "CHANGELOG.md",

45 "scripts/postinstall.js",

46 "scripts/setup-hooks.js"

47 ],

48 "scripts": {

49 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

50 "test": "jest",

51 "test:integration": "jest --testPathIgnorePatterns='\\.worktrees/' --testMatch='**/tests/**/*.integration.test.js'",

52 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='\\.worktrees/' && node scripts/mark-test-passed.js",

53 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

54 "posttest": "node scripts/mark-test-passed.js",

55 "lint": "eslint src/",

56 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "test:thinking": "node scripts/benchmark-thinking.js",

58 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

59 "refresh-models": "node bin/amicus.js models --refresh",

60 "models:info": "node bin/amicus.js models",

61 "models:check": "node bin/amicus.js models --check",

62 "generate-icon": "node scripts/generate-icon.js",

63 "generate-docs": "node scripts/generate-docs.js",

64 "generate-docs:check": "node scripts/generate-docs.js --check",

65 "validate-docs": "node scripts/validate-docs.js --full",

66 "setup-hooks": "node scripts/setup-hooks.js",

67 "check:secrets": "node scripts/check-secrets.js --all",

68 "check:sizes": "node scripts/check-file-sizes.js --all",

69 "check:tarball": "node scripts/check-tarball-lifecycle.js"

70 },

71 "dependencies": {

72 "@modelcontextprotocol/sdk": "^1.27.0",

73 "@opencode-ai/sdk": "^1.1.36",

74 "dotenv": "^17.2.3",

75 "opencode-ai": "^1.2.20",

76 "tiktoken": "^1.0.0",

bin/amicus.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

10// One-time, non-destructive migration of the legacy ~/.config/sidecar dir onto

11// the canonical ~/.config/amicus (copy; legacy kept as a backup). Runs before

12// any config/credential read so both resolve to the unified dir. Best-effort.

13try {

14 const { migrateLegacyConfigDir } = require('../src/utils/config');

15 const _m = migrateLegacyConfigDir();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L13

16 if (_m && _m.migrated) {

17 process.stderr.write(`[amicus] Migrated config ${_m.from} → ${_m.to} (legacy kept as a backup).\n`);

18 }

19} catch { /* best-effort: never block startup on migration */ }

21// Load API keys from all sources: process.env > sidecar .env > auth.json

22const { loadCredentials } = require('../src/utils/env-loader');

23loadCredentials();

25const { parseArgs, getUsage } = require('../src/cli');

26const { validateTaskId } = require('../src/utils/validators');

27const { resolveModelFromArgs, validateFallbackModel } = require('../src/utils/start-helpers');

28const { handleSetup, handleAbort, handleUpdate, handleMcp, handleKey } = require('../src/cli-handlers');

29const { handleStart, handleFanout, handleRead } = require('../src/cli-handlers-run');

30const { isOneShotCommand, armExitWatchdog } = require('../src/utils/lifecycle');

31const { logger } = require('../src/utils/logger');

33const VERSION = require('../package.json').version;

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3/**

4 * Post-install script for amicus

5 *

6 * 1. Copies SKILL.md to ~/.claude/skills/sidecar/

7 * 2. Registers MCP server in Claude Code (~/.claude.json)

8 * 3. Registers MCP server in Claude Desktop/Cowork config

9 */

11const fs = require('fs');

12const path = require('path');

13const os = require('os');

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

14const { execFileSync } = require('child_process');

16const { repairElectron } = require('../src/sidecar/electron-install');

17const HINTS = require('../src/utils/remediation-hints');

19const SETUP_HOOKS_SCRIPT = path.join(__dirname, 'setup-hooks.js');

21/** Short cache-only provision budget: a slow disk must never hang the install. */

22const PROVISION_TIMEOUT_MS = 15000;

24const SKILL_SOURCE = path.join(__dirname, '..', 'skills', 'sidecar', 'SKILL.md');

25const COUNCIL_SOURCE_DIR = path.join(__dirname, '..', 'skills', 'second-opinion');

src/mcp-server.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mcp-server.jsView on unpkg