registry / copilot-framework / 1.6.4
copilot-framework@1.6.4
Contract-first Copilot scaffolding and workspace bootstrap scripts for Edenred repositories.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe automatic lifecycle hook changes project-local agent configuration and enables package-defined behavior without an affirmative setup prompt, leaving a concrete lifecycle setup risk. The inspected changes are first-party scaffolding, preserve existing configuration, and do not establish a hostile attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm installation in a recognized repository, except when the hook detects CI or production mode.
Impact
The repository's agent may follow new automatic session instructions and start the configured local MCP server.
Mechanism
The hook copies missing instruction and skill files, then merges the package's MCP server into the repository's VS Code MCP configuration.
AI rationale
The automatic lifecycle hook changes project-local agent configuration and enables package-defined behavior without an affirmative setup prompt, leaving a concrete lifecycle setup risk. The inspected changes are first-party scaffolding, preserve existing configuration, and do not establish a hostile attack.
Evidence
package.jsonscripts/postinstall.jsworkspace/.vscode/mcp.jsonworkspace/.github/AGENTS.mddist/test/setup-update-mode.test.jsdist/test/update-reindex-mode.test.jsworkspace/.github/copilot-instructions.md
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js automatically; the hook skips CI and production installs, then scaffolds recognized repository roots.
- The hook merges the package's MCP server into project-local .vscode/mcp.json and writes the result, preserving existing server entries.
- The hook copies package-provided agent instructions and skills when missing; those instructions enable automatic session behavior.
- The inspected setup tests check for generated AGENTS.md files, consistent with the scaffolding behavior.
Evidence against
- The configured MCP server runs the package's local entrypoint, and the hook preserves existing project configuration; no external endpoint is configured in the inspected MCP template.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
37const timestamp = new Date().toISOString();
L38: fs.mkdirSync(path.dirname(SETUP_TELEMETRY_PATH), { recursive: true });
L39: fs.appendFileSync(
L40: SETUP_TELEMETRY_PATH,
...
L56: function writePackManifest(packName, source, status, reason) {
L57: fs.mkdirSync(KNOWLEDGE_PACK_STATE_DIR, { recursive: true });
L58: const manifest = {
...
L65: };
L66: fs.writeFileSync(KNOWLEDGE_PACK_MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
L67: }
...
L216: '.github/*.md',
L217: '.github/AGENTS.md',
Critical
Findings
1 Critical4 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.js
HighShips High Entropy Blobworkspace/qa/docs/qa-framework-summary.pdf
HighPrevious Version Dangerous Deltadist/prompt-eval/provider.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/agenred-rag-api/cloud/provision-ado-repo.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to copilot-framework@1.6.4.
See all versions of copilot-framework for other recorded verdicts.
- Review the evidence and your use of copilot-framework@1.6.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.