registry / AI-agent control-surface risk / gm-plugkit
gm-plugkit
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
This report shows the evidence for gm-plugkit@2.0.2575. 5 of 228 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete broad AI-agent control-surface takeover chain, not merely a bootstrapper: it modifies home and project instruction files and executes a remotely obtained native daemon. Absence of an npm lifecycle hook reduces automatic-install risk but does not remove the malicious capability and persistence created by normal invocation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
User runs the gm-plugkit CLI or calls ensureReady().
Impact
Can persist package-controlled instructions across Claude/agent projects and route subsequent agent actions through an opaque downloaded runner.
Mechanism
AI-agent instruction injection plus verified remote binary download and daemon execution
Policy narrative
On an explicit CLI run, ensureReady creates or modifies project AI-agent instruction files and copies package-controlled skills into both ~/.agents and ~/.claude. It downloads a SHA-checked native runner, executes it detached as a spool daemon, and the installed skill instructs agents to dispatch work through that daemon. The hashes verify transport integrity but do not make the opaque remote executable or broad agent-control writes safe.
AI rationale
This is a concrete broad AI-agent control-surface takeover chain, not merely a bootstrapper: it modifies home and project instruction files and executes a remotely obtained native daemon. Absence of an npm lifecycle hook reduces automatic-install risk but does not remove the malicious capability and persistence created by normal invocation.
Evidence
package.jsonbootstrap.jsbootstrap-shared.jsbootstrap-wasm-core.jscli.jsSKILL.md.gm/next-step.md.gm/instructions/CLAUDE.mdAGENTS.md~/.agents/skills/*/SKILL.md~/.claude/skills/*/SKILL.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- bootstrap.js ensureReady writes project AI-agent wiring and instructions.
- bootstrap-shared.js prepends CLAUDE.md and appends AGENTS.md references.
- bootstrap.js installs SKILL.md into ~/.agents and ~/.claude.
- bootstrap.js downloads and executes a native agentplug-runner daemon.
- SKILL.md directs agents to replace questions/summaries with daemon instructions.
Evidence against
- package.json has no npm lifecycle hooks.
- Remote WASM/native downloads are SHA-256 checked before use.
- No credential harvesting or direct data-exfiltration code found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcebootstrap-shared.jsView file
5const os = require('os');
L6: const { spawnSync } = require('child_process');
L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');
High
Child Process
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5bootstrap.jsView file
7const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L38:
L39: const wrapperDir = __dirname;
L40:
...
L45: try {
L46: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L47: if (ownPkg && ownPkg.version) {
...
L168: const dir = gmToolsDir();
L169: const names = process.platform === 'win32'
L170: ? ['agentplug-runner.exe']
Critical
Download Execute
Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js
L7: const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L38:
L39: const wrapperDir = __dirname;
L40:
...
L45: try {
L46: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L47: if (ownPkg && ownPkg.version) {
...
L168: const dir = gmToolsDir();
L169: const names = process.platform === 'win32'
L170: ? ['agentplug-runner.exe']
Findings
2 Critical2 High3 Medium3 Low
CriticalDownload Executebootstrap.js
CriticalTrigger Reachable Dangerous Capabilitybootstrap.js
HighChild Processbootstrap-shared.js
HighKnown Malware Source Similaritycli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gm-plugkit@2.0.2575.
The versions list below shows the verdict for each recorded version.
- Avoid installing gm-plugkit@2.0.2575. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
228 known versions2.0.2575latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 10, 2026, 3:11 PM2.0.2574SuspiciousAI-agent capability abuseWarnPublishedAug 10, 2026, 3:04 PM2.0.2572SuspiciousAI-agent capability abuseWarnPublishedAug 10, 2026, 1:55 PM2.0.2571SuspiciousAI-agent capability abuseWarnPublishedAug 10, 2026, 1:41 PM