global-skills-manager@0.1.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

global-skills-manager@0.1.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/gsm.mjs backup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

17"scripts": { "postinstall": "node bin/gsm.mjs backup", "test": "node --test",

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the manager's backup command.

package.jsonView on unpkg · L17

•scripts.postinstall = node bin/gsm.mjs backup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/gsm.mjsView file

2import { L3: closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, L4: readdirSync, readlinkSync, realpathSync, rmSync, writeFileSync, L5: } from 'node:fs'; ... L15: export const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version; L16: const ROOT = join(homedir(), '.agents'); L17: const SOURCE_PATTERN = /^[a-z0-9][a-z0-9-]*\/[a-z0-9_.-]+$/i; ... L27: remove Stop tracking a skill; -u or --uninstall also deletes it locally L28: backup Save the current desired skill list outside ~/.agents L29: list Show desired skills and their local installation status ... L80: const state = join(root, '.state/skills'); L81: mkdirSync(state, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/gsm.mjsView on unpkg · L2

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node import { closesync, cpsync, existssync, lstatsync, mkdirsync, mkdtempsync, opensync, readfilesync, readdirsync, readlinksync, realpathsync, rmsync, writefilesync, } from 'node:fs'; import { createhash } from 'node:crypto'; import { homedir } from 'node:os'; import { delimiter, dirname, join, resolve } from 'node:path'; import { spawn } from 'node:child_process'; import { fileurltopath } from 'node:url'; import { loadmanifest, loadmanifestfile, readdesired, ensureconfiguration, savemanifest, writejson } from './config.mjs'; export { loadmanifest } from './config.mjs'; export const version = json.parse(readfilesync(new url('../package.json', import.meta.u

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/gsm.mjsView on unpkg

252const guard = dryRun ? undefined : acquireGuard(root); let retainGuard = false; try { if (guard) writeFileSync(join(guard, 'pid'), `${process.pid}\n`); const savedBackup = dryRun ? undefined : ensureConfiguration(root, backupDirectory);

High

Ai Review Evidence

That command unconditionally initializes configuration under the user's global agent directory.

bin/gsm.mjsView on unpkg · L252

bin/config.mjsView file

86export function ensureConfiguration(root, directory) { const sources = readDesired(root, directory); mkdirSync(root, { recursive: true }); try { copyFileSync(new URL('../defaults/AGENTS.md', import.meta.url), join(root, 'AGENTS.md'), constants.COPYFILE_EXCL); } catch (error) { if (error.code !== 'EEXIST') throw error; } try { writeFileSync(join(root, 'skills.json'), `${JSON.stringify({ version: 1, sources }, null, 2)}\n`, { flag: 'wx' });

High

Ai Review Evidence

Initialization copies this package's bundled AGENTS.md into the global agent control surface when absent.

bin/config.mjsView on unpkg · L86

Lines 232-272javascript

232 if (command === 'remove' && (typeof removal !== 'string' || !NAME_PATTERN.test(removal))) {

233 throw new Error('Usage: gsm remove <skill-name> [-u | --uninstall] [--dry-run]');

234 }

235 if (importFile !== undefined && command !== 'install') throw new Error('A manifest path is only supported with gsm install.');

236 const imported = importFile === undefined ? undefined : loadManifestFile(importFile);

237 let sources = readDesired(root, backupDirectory);

238 let lock = command === 'backup' || (command === 'remove' && !uninstall) ? undefined : readLock(root);

239 if (imported) mergeSkills(sources, imported, lock);

240 if (command === 'add') {

241 addition = includeSkill(sources, addition);

242 const previousSource = lock.skills[addition.name]?.source;

243 if (previousSource && previousSource.toLowerCase() !== addition.source.toLowerCase()) {

244 throw new Error(`${addition.name} is already installed from ${previousSource}; refusing to overwrite it.`);

245 }

246 selection = [addition.name];

247 }

248 const allNames = Object.values(sources).flat();

249 for (const name of selection) {

250 if (!allNames.includes(name)) throw new Error(`Unknown desired skill: ${name}`);

251 }

252 const guard = dryRun ? undefined : acquireGuard(root);

253 let retainGuard = false;

254 try {

255 if (guard) writeFileSync(join(guard, 'pid'), `${process.pid}\n`);

256 const savedBackup = dryRun ? undefined : ensureConfiguration(root, backupDirectory);

High

Ai Review Evidence

That command unconditionally initializes configuration under the user's global agent directory.

bin/gsm.mjsView on unpkg · L252

257 if (imported) {

258 if (dryRun) {

259 console.log(`Would merge desired skills from ${importFile} into skills.json.`);

260 } else {

261 // Re-read under the guard so an import preserves the latest current entries.

262 sources = loadManifest(root);

263 lock = readLock(root);

264 const before = JSON.stringify(sources);

265 mergeSkills(sources, imported, lock);

266 if (JSON.stringify(sources) !== before) saveManifest(root, sources, backupDirectory);

267 console.log(`Merged desired skills from ${importFile} into skills.json.`);

268 }

269 }

270 const groups = Object.entries(sources).map(([source, names]) => [source,

271 names.filter(name => !selection.length || selection.includes(name)),

272 ]).filter(([, names]) => names.length);