AI Security Review
scanned 6d ago · by lpm-firewall-aiLPM treats this as warn-only first-party agent extension lifecycle risk. Install-time setup creates package-owned skill packs for the ChainlessChain CLI. This is agent extension lifecycle risk, but no exfiltration, stealth persistence, foreign AI-agent hijack, or unconsented broad control-surface mutation was confirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; later user/agent invokes generated chainlesschain skills
Impact
Adds ChainlessChain skill handlers capable of invoking the ChainlessChain CLI after explicit skill use
Mechanism
first-party skill-pack generation with command handlers
Rationale
The postinstall lifecycle does modify a first-party agent extension surface, so it is not fully clean under the firewall policy. Because the surface is package-owned and the risky execution paths are user/agent-invoked with validation rather than exfiltration or hijack, warn rather than block.
Evidence
package.jsonscripts/postinstall.mjssrc/lib/skill-packs/generator.jssrc/lib/mcp-oauth.jssrc/commands/update.jssrc/auth/npm-auth.jssrc/runtime/agent-core.jssrc/lib/plugin-ecosystem.js<userData>/skills/<cli-domain>/SKILL.md<userData>/skills/<cli-domain>/handler.js~/.chainlesschain/mcp-oauth.json
Network endpoints2
www.chainlesschain.comgit+https://github.com/chainlesschain/chainlesschain.git
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.mjs at install time
- postinstall imports src/lib/skill-packs/generator.js and calls generateCliPacks({force:false})
- generator writes SKILL.md and handler.js into getElectronUserDataDir()/skills for many CLI domains
- generated handlers can later spawn the chainlesschain CLI from agent skill execution
Evidence against
- postinstall writes first-party chainlesschain skill packs, not a foreign broad AI-agent config
- generated handlers validate command names and reject shell metacharacters before shell:true spawnSync
- MCP OAuth code stores tokens under ~/.chainlesschain/mcp-oauth.json with 0600 mode and HTTPS checks
- Runtime npm install is user-invoked update command with semver validation and confirmation
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/auth/npm-auth.jsView file
6L7: import { execSync } from "child_process";
L8: import { logger } from "../lib/logger.js";
High
Child Process
Package source references child process execution.
src/auth/npm-auth.jsView on unpkg · L6src/runtime/agent-core.jsView file
1254// Sensitive-file write guard (Claude-Code 2.1.160 parity): shell startup
L1255: // files / PowerShell profiles / git+husky hooks execute code on the user's
L1256: // next shell or commit — even otherwise-permitted edit flows confirm first.
High
src/lib/plugin-ecosystem.jsView file
86severity: REVIEW_SEVERITY.BLOCKER,
L87: message: "Use of eval() — code injection risk",
L88: penalty: 40,
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/lib/plugin-ecosystem.jsView on unpkg · L86scripts/postinstall.mjsView file
6try {
L7: const { generateCliPacks } = await import(
L8: "../src/lib/skill-packs/generator.js"
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/postinstall.mjsView on unpkg · L6src/harness/prompt-compressor.jsView file
680archivedAt: null,
L681: metadata: { ...(metadata || {}) },
L682: };
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/harness/prompt-compressor.jsView on unpkg · L680src/lib/mcp-oauth.jsView file
30export const _deps = {
L31: fetch: (...a) => globalThis.fetch(...a),
L32: fs: fsDefault,
...
L37: openBrowser: defaultOpenBrowser,
L38: spawn: (...a) => spawn(...a),
L39: now: () => Date.now(),
...
L43: warn: (msg) => {
L44: if (!process.env.VITEST) process.stderr.write(msg);
L45: },
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/lib/mcp-oauth.jsView on unpkg · L3030export const _deps = {
L31: fetch: (...a) => globalThis.fetch(...a),
L32: fs: fsDefault,
...
L37: openBrowser: defaultOpenBrowser,
L38: spawn: (...a) => spawn(...a),
L39: now: () => Date.now(),
...
L43: warn: (msg) => {
L44: if (!process.env.VITEST) process.stderr.write(msg);
L45: },
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
src/lib/mcp-oauth.jsView on unpkg · L30src/commands/init.jsView file
58L59: 通过本地 ComfyUI 服务（默认 http://localhost:8188）生成 AI 图像。
L60:
...
L99:
L100: const COMFYUI_URL = process.env.COMFYUI_URL || "http://localhost:8188";
L101: const POLL_INTERVAL_MS = 2000;
...
L118: res.on("end", () => {
L119: const data = Buffer.concat(dataChunks).toString("utf8");
L120: try {
L121: resolve({ status: res.statusCode, body: JSON.parse(data) });
L122: } catch {
...
L235: ? workflow
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/commands/init.jsView on unpkg · L58src/commands/update.jsView file
2import semver from "semver";
L3: import { execSync } from "node:child_process";
L4: import { checkForUpdates } from "../lib/version-checker.js";
...
L10: /**
L11: * A version that is safe to interpolate into `npm install -g chainlesschain@<v>`.
L12: * The version reaching selfUpdateCli already comes from version-checker (gated by
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/commands/update.jsView on unpkg · L2Findings
7 High5 Medium9 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processsrc/auth/npm-auth.js
HighShellsrc/runtime/agent-core.js
HighSame File Env Network Executionsrc/lib/mcp-oauth.js
HighCommand Output Exfiltrationsrc/lib/mcp-oauth.js
HighSandbox Evasion Gated Capabilitysrc/commands/init.js
HighRuntime Package Installsrc/commands/update.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalsrc/lib/plugin-ecosystem.js
LowWeak Cryptosrc/harness/prompt-compressor.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings