registry / AI-agent capability abuse / bigpowers / 2.88.5

bigpowers@2.88.5

73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has no npm lifecycle script and normal import is inert. Its explicit setup and update commands can modify agent control surfaces and self-update, so the capability warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs bigpowers setup or bigpowers update and selects or confirms an installation.

Impact

Selected agent environments can execute package-provided hook scripts; update can replace the global package release.

Mechanism

Interactive agent-extension installation and hook registration.

AI rationale

Evidence

bin/setup.jsscripts/lib/install-helpers.js.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shbin/bigpowers.js.gemini/extensions/bigpowers~/.gemini/config/plugins/bigpowers~/.gemini/hooks/before-tool-git-guard.sh~/.claude/hooks/block-dangerous-git.sh

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

An explicit setup command can install agent skills and hooks.
The Gemini setup path links a package-owned extension and hook files into user agent directories.
A Gemini hook executes the package's git-guard shell script before tool use.
The explicit update command can globally reinstall the package from npm.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Normal module import only exports package name and version.
Setup is interactive: users choose tools and confirm before files are linked.
The dashboard defaults to a loopback-only HTTP listener; no external endpoint was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

10 flagged

bin/bigpowers.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

2// story: e38s08

3// bigpowers CLI — detects install state, runs setup on demand.

4// No npm lifecycle scripts needed → bypasses npm v10+ allow-scripts gate.

6const { execSync } = require('child_process');

7const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bigpowers.jsView on unpkg · L5

8const os = require('os');

9const path = require('path');

11const ROOT = path.dirname(path.dirname(__filename));

12const SKILLS_MARKER = path.join(os.homedir(), '.claude', 'skills', 'survey-context');

13const pkg = require(path.join(ROOT, 'package.json'));

15function isInstalled() {

16 try {

17 return fs.lstatSync(SKILLS_MARKER).isSymbolicLink();

18 } catch {

19 return false;

20 }

21}

23function run(cmd, cwd = ROOT) {

24 try {

25 execSync(cmd, { cwd, stdio: 'inherit' });

26 } catch (e) {

27 console.error(`\n❌ Failed: ${cmd}`);

28 process.exit(1);

29 }

30}

32// True when this copy runs from the global npm install (not a git clone or npx temp dir).

33function isGlobalInstall() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bigpowers.jsView on unpkg · L24

34 try {

35 const globalRoot = execSync('npm root -g', { encoding: 'utf8' }).trim();

36 return globalRoot && ROOT.startsWith(globalRoot);

37 } catch {

38 return false;

39 }

40}

42// `bigpowers update` used to only re-sync the already-installed files, so it never fetched

43// a newer release. When we're the global install, pull the latest from npm first; the reinstall

44// overwrites ROOT in place, so the setup.js required afterwards is the freshly installed one.

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/bigpowers.jsView on unpkg

skills/visual-dashboard/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

scripts/lib/install-helpers.jsView file

•path = scripts/lib/install-helpers.js kind = trigger_reachable_excluded_payload sizeBytes = 29742 triggerReachableSource = scripts/lib/install-helpers.js excludedPayload = .[redacted]-tool-git-guard.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

scripts/lib/install-helpers.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. in(rendereddir, f), path.join(targetdir, f)); } } } { const agentssrc = path.join(reporoot, 'agents.md'); const agentsdst = path.join(homedir, '.kilocode', 'agents.md'); fs.mkdirsync(path.dirname(agentsdst), { recursive: true }); if (fs.existssync(agentssrc)) fs.copyfilesync(agentssrc, agentsdst); } break; case 'trae': linkrenderedskills(path.join(reporoot, '.trae/skills'), path.join(homedir, '.trae', 'skills')); { const agentssrc = path.join(reporoot, 'agents.md'); const agentsdst = path.join(homedir, '.trae', 'agents.md'); fs.mkdirsync(path.dirname

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/lib/install-helpers.jsView on unpkg

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView file

•path = .[redacted]-tool-git-guard.sh kind = payload_in_excluded_dir sizeBytes = 669 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView on unpkg

•path = .[redacted]-tool-git-guard.sh kind = build_helper sizeBytes = 669 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView on unpkg

Source & flagged code

10 flagged · loading source

bin/bigpowers.jsView file

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L5

24try { L25: execSync(cmd, { cwd, stdio: 'inherit' }); L26: } catch (e) { ... L31: L32: // True when this copy runs from the global npm install (not a git clone or npx temp dir). L33: function isGlobalInstall() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bigpowers.jsView on unpkg · L24

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/bigpowers.jsView on unpkg

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

Findings

1 Critical7 High5 Medium4 Low

CriticalTrigger Reachable Excluded Directory Payloadscripts/lib/install-helpers.js

HighChild Processbin/bigpowers.js

HighShell

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/lib/install-helpers.js

HighRuntime Package Installbin/bigpowers.js

HighPayload In Excluded Dir.gemini/extensions/bigpowers/hooks/before-tool-git-guard.sh

HighSemantic Analysis Limitedbin/bigpowers.js

HighKnown Malware Source Similarityskills/visual-dashboard/scripts/server.cjs

MediumDynamic Requirebin/bigpowers.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.gemini/extensions/bigpowers/hooks/before-tool-git-guard.sh

Affected versions and remediation

This report applies to bigpowers@2.88.5.

See all versions of bigpowers for other recorded verdicts.

Review the evidence and your use of bigpowers@2.88.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 15:24:32.619Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code