registry / AI-agent control-surface risk / bmad-speckit-sdd-flow
bmad-speckit-sdd-flow
Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit
This report shows the evidence for bmad-speckit-sdd-flow@3.0.0. 5 of 6 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiPostinstall unconditionally deploys Cursor hooks, rules, skills, and commands into the consumer project, which is an unconsented mutation of a foreign agent control surface. Optional MCP and package.json flags do not gate that default hook install.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall of bmad-speckit-sdd-flow, which executes scripts/init-to-root.js.
Impact
A normal install persistently hooks the consumer Cursor agent so later sessions and tool calls execute package-supplied hook scripts.
Mechanism
The script resolves the consumer root from INIT_CWD, defaults the agent to cursor, copies commands, rules, skills, and hook scripts into .cursor, and writes .cursor/hooks.json so Cursor runs those scripts on session and tool events.
Policy narrative
On npm install, postinstall launches scripts/init-to-root.js. With no --agent flag it selects cursor and treats INIT_CWD as the project to modify. It copies the package _bmad tree into that project and syncs commands, rules, skills, agents, and hook scripts into .cursor. It then writes .cursor/hooks.json so Cursor starts node hook scripts on sessionStart, preToolUse, subagentStart, subagentStop, and postToolUse. That is an install-time takeover of the editor agent control surface. MCP files and a nested npm install stay behind explicit flags.
AI rationale
Postinstall unconditionally deploys Cursor hooks, rules, skills, and commands into the consumer project, which is an unconsented mutation of a foreign agent control surface. Optional MCP and package.json flags do not gate that default hook install.
Evidence
package.jsonscripts/init-to-root.js.cursor/hooks.json.cursor/hooks.cursor/commands.cursor/rules.cursor/skills.cursor/agents_bmad_bmad-output/config/bmad-speckit.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 88.0% confidence with low false-positive risk.
Evidence for policy risk
- npm postinstall runs node scripts/init-to-root.js with no extra consent flag.
- When --agent is omitted the installer selects the cursor profile.
- During postinstall the copy target is the consumer project from INIT_CWD.
- The cursor profile writes .cursor/hooks.json that registers sessionStart, preToolUse, subagentStart, subagentStop, and postToolUse node commands.
- The same postinstall sync copies commands, rules, skills, agents, and hook scripts into the consumer .cursor tree and copies _bmad into the project root.
Evidence against
- Consumer MCP layout runs only with --with-mcp, and a nested npm install runs only with --with-package-json.
- The installer script has no outbound URL or credential send.
- The same-name package entry is a devDependency file: link, not a published runtime self-install chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/init-to-root.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg_bmad/cursor/hooks/subagent-result-summary.cjsView file
5const path = require('node:path');
L6: const { spawnSync } = require('node:child_process');
L7:
High
Child Process
Package source references child process execution.
_bmad/cursor/hooks/subagent-result-summary.cjsView on unpkg · L5_bmad/skills/governed-feature-delivery/scripts/run-phase.mjsView file
Findings
1 Critical19 High5 Medium8 Low
CriticalAi Agent Control Hijackscripts/init-to-root.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Process_bmad/cursor/hooks/subagent-result-summary.cjs
HighShell_bmad/skills/governed-feature-delivery/scripts/run-phase.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/init-to-root.js
HighRuntime Package Installnode_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjs
HighPayload In Excluded Dir_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py
HighSemantic Analysis Limited_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.js
HighKnown Malware Source Similaritynode_modules/@bmad-speckit/runtime-emit/dist/emit-runtime-policy.cjs
Affected versions and remediation
This report applies to bmad-speckit-sdd-flow@3.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing bmad-speckit-sdd-flow@3.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
6 known versions3.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 22, 2026, 7:07 PM2.2.2Scan Failed—AllowUnder ReviewSep 19, 2026, 7:13 PM2.2.1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 12, 2026, 7:06 AM2.1.12MaliciousSoft block: AI-agent control surfaceBlockPublished