AI Security Review
scanned 1d ago · by lpm-firewall-aiLPM treats this as warn-only first-party agent extension lifecycle risk. Install-time code plants a package-supplied CELL extension into the user's global CELL agent extensions directory. This is first-party agent extension lifecycle risk, but inspection did not confirm foreign agent hijack or data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / postinstall
Impact
The bundled fivo extension becomes globally discoverable by the CELL agent and can hook prompts/messages, store memory, alter active tools, and register slash commands.
Mechanism
lifecycle copy into user-home agent extension directory
Policy narrative
During npm postinstall, the package creates ~/.cell/agent/extensions, copies the bundled .pi/extensions/fivo.ts into it, and deletes an older ~/.cell/extensions/fivo.ts path. The CELL runtime later discovers ~/.cell/agent/extensions and loads extension files. The planted extension hooks agent prompts/messages, manages memory and vault files, changes active tools, and registers commands, but the behavior remains within the package's declared .cell agent namespace and no exfiltration endpoint or foreign AI-agent control surface write was found.
Rationale
The inspected source confirms unprompted lifecycle installation of an agent extension, which is risky because it modifies user-home agent behavior at install time. Under the policy, this is package-aligned first-party agent extension setup and should be warned rather than blocked absent foreign control-surface mutation, persistence outside the platform contract, remote code, or exfiltration.
Evidence
package.json.pi/extensions/fivo.tsdist/core/extensions/loader.jsdist/config.jsdist/cli.jsdist/index.js~/.cell/agent/extensions/fivo.ts~/.cell/extensions/fivo.ts~/.cell/memory.json~/.cell/vault.json~/.cell/vibe.md~/.cell/mode.json~/.cell/themes/cell-orange.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall executes on install.
- postinstall creates ~/.cell/agent/extensions and copies .pi/extensions/fivo.ts to ~/.cell/agent/extensions/fivo.ts.
- postinstall removes ~/.cell/extensions/fivo.ts if present.
- dist/core/extensions/loader.js auto-discovers global extensions under getAgentDir()/extensions, and getAgentDir resolves to ~/.cell/agent.
- .pi/extensions/fivo.ts hooks agent events and stores memory/vault/theme files under ~/.cell.
Evidence against
- The lifecycle target is the package's own piConfig .cell namespace, not Claude/Codex/Cursor/MCP or shell startup files.
- No install-hook network call, remote payload download, or hardcoded exfiltration endpoint found.
- The extension redacts common secrets on input and shows vault keys as set/masked rather than exfiltrating values.
- dist/cli.js only sets process title/env, configures HTTP dispatcher, and calls main().
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgexamples/extensions/doom-overlay/doom-engine.tsView file
64const nativeRequire = createRequire(doomJsPath);
L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);
L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);
Low
Eval
Package source references a known benign dynamic code generation pattern.
examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64dist/core/extensions/loader.jsView file
52};
L53: const require = createRequire(import.meta.url);
L54: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core/extensions/loader.jsView on unpkg · L52examples/extensions/doom-overlay/doom/build/doom.wasmView file
•path = examples/extensions/doom-overlay/doom/build/doom.wasm
kind = wasm_module
sizeBytes = 380169
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkgexamples/extensions/doom-overlay/doom/build.shView file
•path = examples/extensions/doom-overlay/doom/build.sh
kind = build_helper
sizeBytes = 3366
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
examples/extensions/doom-overlay/doom/build.shView on unpkgFindings
1 Critical1 High6 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm
MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalexamples/extensions/doom-overlay/doom-engine.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings