Loading npm security reports…

git-workflow-skill@1.0.0: AI-agent control-surface risk | LPM Firewall

registry / git-workflow-skill / 1.0.0

git-workflow-skill@1.0.0

gitflow — end-to-end GitHub delivery skill for AI agents: feature branch → atomic commits → validation → pull request → merge → cleanup → GitHub Projects tasks. Team-safe (respects branch protection), stack-agnostic. Auto-installs into .agents/skills or .

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package writes an agent skill into two consuming-project AI-agent control surfaces. The write is automatic and force-overwrites any existing gitflow skill.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs postinstall

Impact

Unconsented modification of .agents/skills and .claude/skills can change AI-agent behavior in the consuming project.

Mechanism

project-root traversal and forced recursive skill copy

Policy narrative

Installing the npm package triggers a postinstall script. It identifies the consuming project by walking out of node_modules, then creates and force-copies a behavior-bearing skill into both .agents/skills/gitflow and .claude/skills/gitflow. This mutates broad AI-agent control surfaces without an explicit setup command or consent at the point of mutation.

Rationale

This is a concrete, install-time, unconsented mutation of foreign/broad AI-agent control surfaces. No separate exfiltration or remote payload behavior was found, but the lifecycle control-surface write meets the block boundary.

Evidence

package.jsonscripts/install.mjsskills/gitflow/SKILL.mdskills/gitflow/<project-root>/.agents/skills/gitflow/<project-root>/.claude/skills/gitflow/

Decision evidence

public snapshot

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

36"scripts": { "postinstall": "node ./scripts/install.mjs" }

High

Suspicious Lifecycle Evidence

npm postinstall executes install.mjs.

package.jsonView on unpkg · L36

•scripts.postinstall = node ./scripts/install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.mjsView file

1Install-time AI-agent control hijack evidence: L5: * Copies the `gitflow` skill into the consuming project so agents that read L6: * `.agents/skills/` or `.claude/skills/` pick it up automatically. L7: * ... L11: */ L12: import { cpSync, existsSync, mkdirSync } from "node:fs"; L13: import { dirname, join, sep } from "node:path"; ... L28: L29: const targets = [".agents/skills", ".claude/skills"]; L30: ... L36: const dest = join(root, target, "gitflow"); L37: mkdirSync(dirname(dest), { recursive: true }); L38: cpSync(skillSrc, dest, { recursive: true, force: true }); Payload evidence from [redacted]-messages.md: L1: # Conventional Commits — Cheat Sheet L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.mjsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node import { cpsync, existssync, mkdirsync } from "node:fs"; import { dirname, join, sep } from "node:path"; import { fileurltopath } from "node:url"; const here = dirname(fileurltopath(import.meta.url)); const skillsrc = join(here, "..", "

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.mjsView on unpkg

29const targets = [".agents/skills", ".claude/skills"]; let installed = 0; const root = projectRoot(); for (const target of targets) { try { if (!existsSync(skillSrc)) continue; const dest = join(root, target, "gitflow"); mkdirSync(dirname(dest), { recursive: true }); cpSync(skillSrc, dest, { recursive: true, force: true });

High

Ai Review Evidence

Installer derives the consuming project root and writes both .agents and .claude skill directories.

scripts/install.mjsView on unpkg · L29

36const dest = join(root, target, "gitflow"); mkdirSync(dirname(dest), { recursive: true }); cpSync(skillSrc, dest, { recursive: true, force: true }); installed++; console.log(`✔ gitflow skill installed → ${target}/gitflow/`);

High

Ai Review Evidence

It recursively overwrites the gitflow skill with force.

scripts/install.mjsView on unpkg · L36