registry / AI-agent control-surface risk / global-skills-manager

global-skills-manager

Install and update desired agent skills in ~/.agents

This report shows the evidence for global-skills-manager@0.1.0, the only known version.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an unconsented postinstall mutation of a broad global AI-agent control surface. Exclusive creation avoids overwrites but does not remove the risk of first-install persistence.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation.

Impact

The package can establish persistent instructions affecting future AI-agent activity without an explicit setup command.

Mechanism

Automatic creation of a global agent instruction file.

Policy narrative

Installing the package runs its postinstall hook. The hook calls the backup command, which initializes the global ~/.agents directory and copies the package's AGENTS.md if absent. That bundled file declares rules for all agents across all scenarios, creating a persistent broad agent-control surface without an explicit user setup action.

AI rationale

This is an unconsented postinstall mutation of a broad global AI-agent control surface. Exclusive creation avoids overwrites but does not remove the risk of first-install persistence.

Evidence

package.jsonbin/gsm.mjsbin/config.mjsdefaults/AGENTS.md~/.agents/AGENTS.md~/.agents/skills.json~/.gsm/backups

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the manager's backup command.
That command unconditionally initializes configuration under the user's global agent directory.
Initialization copies this package's bundled AGENTS.md into the global agent control surface when absent.
The bundled file says its instructions apply to all agents across all scenarios.

Evidence against

The automatic path does not invoke the npx downloader; that occurs only during later skill-install commands.
The AGENTS.md copy uses exclusive creation and does not overwrite an existing file.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 22.9 KB of source, external domains: github.com

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node bin/gsm.mjs backup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

17"scripts": { "postinstall": "node bin/gsm.mjs backup", "test": "node --test",

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the manager's backup command.

package.jsonView on unpkg · L17

•scripts.postinstall = node bin/gsm.mjs backup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/gsm.mjsView file

2import { L3: closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, L4: readdirSync, readlinkSync, realpathSync, rmSync, writeFileSync, L5: } from 'node:fs'; ... L15: export const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version; L16: const ROOT = join(homedir(), '.agents'); L17: const SOURCE_PATTERN = /^[a-z0-9][a-z0-9-]*\/[a-z0-9_.-]+$/i; ... L27: remove Stop tracking a skill; -u or --uninstall also deletes it locally L28: backup Save the current desired skill list outside ~/.agents L29: list Show desired skills and their local installation status ... L80: const state = join(root, '.state/skills'); L81: mkdirSync(state, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/gsm.mjsView on unpkg · L2

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node import { closesync, cpsync, existssync, lstatsync, mkdirsync, mkdtempsync, opensync, readfilesync, readdirsync, readlinksync, realpathsync, rmsync, writefilesync, } from 'node:fs'; import { createhash } from 'node:crypto'; import { homedir } from 'node:os'; import { delimiter, dirname, join, resolve } from 'node:path'; import { spawn } from 'node:child_process'; import { fileurltopath } from 'node:url'; import { loadmanifest, loadmanifestfile, readdesired, ensureconfiguration, savemanifest, writejson } from './config.mjs'; export { loadmanifest } from './config.mjs'; export const version = json.parse(readfilesync(new url('../package.json', import.meta.u

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/gsm.mjsView on unpkg

252const guard = dryRun ? undefined : acquireGuard(root); let retainGuard = false; try { if (guard) writeFileSync(join(guard, 'pid'), `${process.pid}\n`); const savedBackup = dryRun ? undefined : ensureConfiguration(root, backupDirectory);

High

Ai Review Evidence

That command unconditionally initializes configuration under the user's global agent directory.

bin/gsm.mjsView on unpkg · L252

bin/config.mjsView file

86export function ensureConfiguration(root, directory) { const sources = readDesired(root, directory); mkdirSync(root, { recursive: true }); try { copyFileSync(new URL('../defaults/AGENTS.md', import.meta.url), join(root, 'AGENTS.md'), constants.COPYFILE_EXCL); } catch (error) { if (error.code !== 'EEXIST') throw error; } try { writeFileSync(join(root, 'skills.json'), `${JSON.stringify({ version: 1, sources }, null, 2)}\n`, { flag: 'wx' });

High

Ai Review Evidence

Initialization copies this package's bundled AGENTS.md into the global agent control surface when absent.

bin/config.mjsView on unpkg · L86

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/gsm.mjs backup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

17"scripts": { "postinstall": "node bin/gsm.mjs backup", "test": "node --test",

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the manager's backup command.

package.jsonView on unpkg · L17

•scripts.postinstall = node bin/gsm.mjs backup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/gsm.mjsView file

Findings

1 Critical5 High3 Medium3 Low

CriticalAi Agent Control Hijackbin/gsm.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/gsm.mjs

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencebin/gsm.mjs

HighAi Review Evidencebin/config.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to global-skills-manager@0.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing global-skills-manager@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 07:42:42.127Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.1.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 12, 2026, 4:51 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code