registry / copilot-framework / 1.3.1

copilot-framework@1.3.1

Contract-first Copilot scaffolding and workspace bootstrap scripts for Edenred repositories.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The package mutates AI-agent and MCP control surfaces during npm install. Even though this matches the package theme, the postinstall hook writes agent instructions and MCP configuration into the installing repository without an explicit CLI action.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of copilot-framework in a repository-like directory

Impact

Installer can change future Copilot/agent behavior and register a local MCP server for the workspace.

Mechanism

postinstall scaffolds .github agent instructions and .vscode MCP config

Policy narrative

On install, scripts/postinstall.js detects a repository root and writes package-supplied .github agent guidance plus .vscode/mcp.json into the target project, then hides those generated paths in .gitignore. This creates an unconsented lifecycle mutation of AI-agent/MCP control files, even though no exfiltration endpoint or destructive payload was found.

Rationale

Source inspection confirms install-time writes to AI-agent instructions and MCP config, which is a concrete unconsented control-surface mutation. No network theft was found, but the lifecycle behavior itself is blocking under the firewall policy. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonscripts/postinstall.jsworkspace/.github/AGENTS.mdworkspace/.github/copilot-instructions.mdworkspace/.vscode/mcp.json.github/AGENTS.md.github/copilot-instructions.md

copilot-framework@1.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code