registry / AI-agent control-surface risk / bigpowers

bigpowers

72 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers

This report shows the evidence for bigpowers@2.44.0. 1 of 56 known versions is blocked or flagged. The newest version, 2.88.9, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct source inspection confirms automatic postinstall global agent configuration and hook injection. This meets the firewall block policy even though no exfiltration endpoint was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install (postinstall)

Impact

Future agent sessions and tool calls can execute package-linked hooks without a separate user setup command.

Mechanism

global AI-agent hook/configuration injection

Policy narrative

The install lifecycle invokes install.sh without user interaction. That script installs global symlinks and, when Claude or Gemini settings exist, appends command hooks to their global configuration. This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces; later sessions/tool calls can invoke package-linked commands.

AI rationale

Direct source inspection confirms automatic postinstall global agent configuration and hook injection. This meets the firewall block policy even though no exfiltration endpoint was found.

Evidence

package.jsonscripts/install.shscripts/sync-skills.shhooks/pre-tool-use.sh~/.claude/skills/*~/.claude/hooks/*~/.claude/settings.json~/.gemini/extensions/bigpowers~/.gemini/hooks/*~/.gemini/settings.json~/.cursor/rules

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json postinstall runs scripts/install.sh automatically.
scripts/install.sh symlinks skills/hooks into ~/.claude and ~/.gemini.
scripts/install.sh rewrites ~/.claude/settings.json to add SessionStart and PreToolUse hooks.
scripts/install.sh rewrites ~/.gemini/settings.json to add SessionStart and BeforeTool hooks.
It also replaces ~/.cursor/rules with a package-controlled symlink.

Evidence against

No credential harvesting or external exfiltration found.
Dashboard server defaults to 127.0.0.1.
index.js only exports package metadata.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 128 KB of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.install = bash scripts/install.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = bash scripts/install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/sync-skills.sh && bash scripts/install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bigpowers.jsView file

2L3: const { execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L2

2L3: const { execSync } = require('child_process'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bigpowers.jsView on unpkg · L2

skills/visual-dashboard/scripts/server.cjsView file

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BIGPOWERS_DASHBOARD_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BIGPOWERS_DASHBOARD_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/visual-dashboard/scripts/server.cjsView on unpkg · L1

skills/extract-design/scripts/lib/validator.jsView file

1import { execSync } from 'node:child_process'; L2: import { existsSync } from 'node:fs'; L3: import { log } from './logging.js'; L4: const BIN = 'npx @google/design.md'; L5:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/extract-design/scripts/lib/validator.jsView on unpkg · L1

hooks/pre-tool-use.shView file

•path = hooks/pre-tool-use.sh kind = build_helper sizeBytes = 4233 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/pre-tool-use.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.install = bash scripts/install.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = bash scripts/install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/sync-skills.sh && bash scripts/install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bigpowers.jsView file

Findings

4 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/bigpowers.js

HighShell

HighRuntime Package Installskills/extract-design/scripts/lib/validator.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/bigpowers.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperhooks/pre-tool-use.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoskills/visual-dashboard/scripts/server.cjs

LowFilesystem

Affected versions and remediation

This report applies to bigpowers@2.44.0.

The versions list below shows the verdict for each recorded version.

Avoid installing bigpowers@2.44.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-28 08:28:55.785Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

56 known versions

2.88.9latestClean—AllowPublishedSep 21, 2026, 6:01 PM 2.88.7SuspiciousAI-agent capability abuseWarnPublishedSep 17, 2026, 4:28 PM 2.88.6Clean—AllowPublishedSep 13, 2026, 3:37 PM 2.88.5SuspiciousAI-agent capability abuseWarnPublishedSep 13, 2026, 3:20 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code