Loading npm security reports…

ani-skills@2.1.0: AI-agent control-surface risk | LPM Firewall

registry / ani-skills / 2.1.0

ani-skills@2.1.0

ANI-Skills Ultra is a comprehensive AI Agent Skills library with 3,048+ skills across 29 semantic namespaces for Antigravity, Claude Code, Cursor, Windsurf, Copilot, Codex, Gemini CLI, and OpenCode, featuring an interactive GUI installer.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package invokes an automatic installer that populates project and user-global skill directories for every detected AI agent. It can replace existing skill directories with a symlink to the package's skill collection.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

It changes multiple foreign AI-agent control surfaces without an explicit user command or agent selection.

Mechanism

Automatic broad AI-agent skill installation and directory replacement

Policy narrative

npm runs bin/install.js with --auto during postinstall. The installer enumerates installed AI agents and, for each detected one, installs all skills to both the current project's agent directory and the user's global agent directory. Where linking is enabled, it force-removes an existing target skill directory and replaces it with a symlink to this package. This is an unconsented, broad mutation of third-party AI-agent control surfaces.

Rationale

The automatic postinstall path broadly modifies foreign project and user-global AI-agent skill directories, including destructive replacement of existing directories. This meets the install-control-surface blocking policy.

Evidence

package.jsonbin/install.js.claude/skills.cursor/skills.windsurf/skills.github/skills.agents/skills.gemini/skills.opencode/skills

Decision evidence

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --auto

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.js --auto

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView file

22patternName = google_api_key severity = high line = 22

High

High Secret

Package contains a high-severity secret pattern.

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

22patternName = google_api_key severity = high line = 22

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

596patternName = google_api_key severity = high line = 596

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L596

742patternName = google_api_key severity = high line = 742

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L742

bin/install.jsView file

30trigger: path.join(homeDir, '.gemini', 'config'), L31: projectPath: path.join(cwd, '.agents', 'skills'), L32: globalPath: path.join(homeDir, '.gemini', 'config', 'skills'), ... L41: name: 'Claude Code', L42: trigger: path.join(homeDir, '.claude'), L43: projectPath: path.join(cwd, '.claude', 'skills'), L44: globalPath: path.join(homeDir, '.claude', 'skills'), L45: docs: 'https://docs.anthropic.com/en/docs/claude-code/skills', ... L73: name: 'Codex (OpenAI)', L74: trigger: path.join(homeDir, '.agents'), L75: projectPath: path.join(cwd, '.agents', 'skills'), L76: globalPath: path.join(homeDir, '.agents', 'skills'),

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L30

15const os = require('os'); L16: const { exec, execSync } = require('child_process'); L17:

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L15

13const path = require('path'); L14: const http = require('http'); L15: const os = require('os'); L16: const { exec, execSync } = require('child_process'); L17: ... L20: const geminiCmdSrc = path.join(projectRoot, '.gemini', 'commands'); L21: const homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir(); L22: const cwd = process.cwd();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/install.js

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView file

129for (let i = 0; i < retries; i++) { L130: const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' }); L131: if (result.status === 0) {

High

Shell

Package source references shell execution.

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView on unpkg · L129

skills/skills-webmcp-gen/scripts/compile.mjsView file

157} L158: if (implementationSource.includes("eval(") || implementationSource.includes("new Function")) { L159: errors.push(`Tool "${tool.name}" uses eval/new Function.`);

High

Eval

Package source references dynamic code evaluation.

skills/skills-webmcp-gen/scripts/compile.mjsView on unpkg · L157

skills/skills-browser-to-api/scripts/infer.mjsView file

98endpoint: ep.endpointKey, L99: request: { status: pickedReqStatus, headers: reqHeaders, body: reqExample }, L100: response: { status: pickedRespStatus, headers: respHeaders, body: respExample },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/skills-browser-to-api/scripts/infer.mjsView on unpkg · L98

skills/gstack-browse/src/cookie-import-browser.tsView file

196if (fs.existsSync(prefsPath)) { L197: const prefs = JSON.parse(fs.readFileSync(prefsPath, 'utf-8')); L198: const email = prefs?.account_info?.[0]?.email; ... L319: function getHostPlatform(): BrowserPlatform | null { L320: const p = process.platform; L321: if (p === 'darwin' || p === 'linux' || p === 'win32') return p as BrowserPlatform; ... L341: function getBaseDir(platform: BrowserPlatform): string { L342: if (platform === 'darwin') return path.join(os.homedir(), 'Library', 'Application Support'); L343: if (platform === 'win32') return path.join(os.homedir(), 'AppData', 'Local'); ... L527: L528: const proc = Bun.spawn(['powershell', '-NoProfile', '-Command', script], { L529: windowsHide: true,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

skills/gstack-browse/src/cookie-import-browser.tsView on unpkg · L196

skills/gstack-browse/src/cli.tsView file

8* 4. Send command via HTTP POST L9: * 5. Print response to stdout (or stderr for errors) L10: */ ... L13: import * as path from 'path'; L14: import { spawn as nodeSpawn } from 'child_process'; L15: import { safeUnlink, safeUnlinkQuiet, safeKill, isProcessAlive } from './error-handling'; ... L25: const config = resolveConfig(); L26: const IS_WINDOWS = process.platform === 'win32'; L27: ... L40: */ L41: export function resolveStartTimeout(env: NodeJS.ProcessEnv = process.env): number { L42: // Cold Chromium launch measured ~5.7s at load avg 10 on a dev machine running

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

skills/gstack-browse/src/cli.tsView on unpkg · L8

skills/postiz-agent-postiz/src/commands/auth.tsView file

5L6: const CREDENTIALS_DIR = join(homedir(), '.postiz'); L7: const CREDENTIALS_FILE = join(CREDENTIALS_DIR, 'credentials.json'); L8: L9: const DEFAULT_AUTH_SERVER = 'https://cli-auth.postiz.com'; L10: ... L19: if (!existsSync(CREDENTIALS_FILE)) return null; L20: const data = JSON.parse(readFileSync(CREDENTIALS_FILE, 'utf-8')); L21: if (!data.accessToken) return null; ... L43: function openBrowser(url: string): void { L44: const { exec } = require('child_process'); L45: const platform = process.platform;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

skills/postiz-agent-postiz/src/commands/auth.tsView on unpkg · L5

skills/humanizer-ru/demo/markers.jsView file

206contains invisible/control Unicode U+202A (left-to-right embedding) "source": "[<U+200B><U+200C><U+200E><U+200F><U+202A>-<U+202E><U+2060>-⁤<U+2066>-<U+2069><U+FEFF>￹-￻]|(?<![🀀-🫿☀-➿️🇦-🇿])<U+200D>(?![🀀-🫿☀-➿️🇦-🇿])",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

skills/humanizer-ru/demo/markers.jsView on unpkg · L206

skills/playwright-skill/templates/lambdatest-setup.tsView file

13* Run: L14: * npx playwright test --project=chromium # local L15: * npx playwright test --project="chrome:latest:Windows 11@lambdatest" # cloud ... L19: import { chromium } from 'playwright'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/playwright-skill/templates/lambdatest-setup.tsView on unpkg · L13

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView file

•path = skills/sk[redacted]/scripts/calculate_cost.py kind = build_helper sizeBytes = 12190 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView file

•path = skills/sk[redacted]/tests/test_run_mr_brain_finetune.py kind = payload_in_excluded_dir sizeBytes = 6761 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView on unpkg

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView on unpkg

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L41

96patternName = generic_password severity = medium line = 96

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L96

skills/skills-firebase-apk-scanner/scanner.shView file

524patternName = generic_password severity = medium line = 524

Medium

Secret Pattern

Hardcoded password in skills/skills-firebase-apk-scanner/scanner.sh

skills/skills-firebase-apk-scanner/scanner.shView on unpkg · L524

Findings

3 Critical16 High10 Medium5 Low

CriticalCredential Exfiltrationskills/gstack-browse/src/cookie-import-browser.ts

CriticalAi Agent Control Hijackbin/install.js

CriticalTrojan Source Unicodeskills/humanizer-ru/demo/markers.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretskills/skills-firebase-apk-scanner/references/vulnerabilities.md

HighChild Processbin/install.js

HighShellskills/baoyu-post-to-weibo/scripts/paste-from-clipboard.ts

HighEvalskills/skills-webmcp-gen/scripts/compile.mjs

HighSame File Env Network Executionbin/install.js

HighCommand Output Exfiltrationskills/gstack-browse/src/cli.ts

HighSandbox Evasion Gated Capabilityskills/postiz-agent-postiz/src/commands/auth.ts

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js

HighRuntime Package Installskills/playwright-skill/templates/lambdatest-setup.ts

HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf

HighPayload In Excluded Dirskills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.py

HighSemantic Analysis Limitedskills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjs

HighSecret Patternskills/skills-firebase-apk-scanner/references/vulnerabilities.md

HighSecret Patternskills/skills-firebase-apk-scanner/references/vulnerabilities.md

HighSecret Patternskills/skills-firebase-apk-scanner/references/vulnerabilities.md

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/install.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/skills-agent-platform-tuning/scripts/calculate_cost.py

MediumShips Compressed Blobskills/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

MediumSecret Patternskills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

MediumSecret Patternskills/skills-firebase-apk-scanner/scanner.sh

LowScripts Present

LowWeak Cryptoskills/skills-browser-to-api/scripts/infer.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings