registry / AI-agent control-surface risk / bob-worktrees
bob-worktrees
Git worktree management for parallel development with IBM Bob IDE. Installs globally and auto-configures the MCP server so Bob can create, switch, merge, and delete worktrees via natural language.
This report shows the evidence for bob-worktrees@2.1.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package uses an automatic npm lifecycle hook to modify a global AI-agent configuration rather than requiring an explicit user setup action. The registered server can then execute repository-supplied commands, making the combined path concrete install-hook abuse.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation, followed by Bob invoking the registered MCP worktree-creation tool.
Impact
A package install changes a broad AI-agent control surface without an explicit setup command; subsequent agent use can execute commands from the opened repository.
Mechanism
Automatic global MCP registration plus execution of repository-supplied hook commands.
Policy narrative
The postinstall hook selects or creates a global Bob MCP configuration file and inserts an entry that launches the package's MCP server. This occurs automatically on installation and can reset malformed configuration. Once loaded by Bob, the server's worktree-creation path reads a repository hooks file and executes each configured command. The automatic broad agent configuration mutation and resulting command-execution path create an unconsented control-surface risk.
AI rationale
This package uses an automatic npm lifecycle hook to modify a global AI-agent configuration rather than requiring an explicit user setup action. The registered server can then execute repository-supplied commands, making the combined path concrete install-hook abuse.
Evidence
package.jsonscripts/postinstall.jsmcp-server/index.js~/.bob/settings/mcp.json~/.bob/mcp.json~/.config/bob/mcp.json.bob-worktrees/hooks.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest automatically runs a postinstall script.
- Postinstall targets Bob's global MCP configuration locations and registers a server launched from this package.
- The install hook creates parent directories and rewrites the selected global MCP configuration; malformed existing configuration is reset.
- The registered MCP server can execute commands supplied by a repository hooks file when a worktree is created.
Evidence against
- No network requests, credential harvesting, self-dependency, or payload download were found.
- The registered command points to the package's local MCP server rather than a remote executable.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg18"scripts": {
"start": "node cli/index.js",
"mcp": "node mcp-server/index.js",
"postinstall": "node scripts/postinstall.js",
"test": "node --test tests/postinstall.test.js tests/mcp-server.test.js",
"health": "node scripts/health-check.cjs"
},
High
Suspicious Lifecycle Evidence
The manifest automatically runs a postinstall script.
package.jsonView on unpkg · L18•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
Findings
1 Critical6 High3 Medium2 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencescripts/postinstall.js
HighSuspicious Lifecycle Evidencescripts/postinstall.js
HighSuspicious Lifecycle Evidencescripts/postinstall.js
HighAi Review Evidencemcp-server/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to bob-worktrees@2.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing bob-worktrees@2.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.