registry / gm-plugkit / 2.0.2465
gm-plugkit@2.0.2465
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has no automatic npm install trigger, so the source does not meet the block threshold. Its explicit CLI path nevertheless performs broad, remotely controlled AI-agent extension setup and project instruction mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs gm-plugkit CLI or calls ensureReady().
Impact
Remote repository changes can alter instructions installed into ~/.agents and ~/.claude; project agent control files are also changed.
Mechanism
Remote skill retrieval plus AI-agent configuration mutation and WASM bootstrap.
AI rationale
The package has no automatic npm install trigger, so the source does not meet the block threshold. Its explicit CLI path nevertheless performs broad, remotely controlled AI-agent extension setup and project instruction mutation.
Evidence
package.jsoncli.jsbootstrap.jsbootstrap-shared.jsbootstrap-wasm-core.jsSKILL.md~/.agents/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md<project>/CLAUDE.md<project>/AGENTS.md<project>/.gm/next-step.md<project>/.gm/instructions/~/.gm-tools/plugkit.wasm
Network endpoints4
api.github.com/repos/AnEntrypoint/gm/contents/skills?ref=mainraw.githubusercontent.com/AnEntrypoint/gm/main/skills/<skill>/SKILL.mdgithub.com/AnEntrypoint/plugkit-bin/releases/download/v<version>registry.npmjs.org/gm-plugkit/latest
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- bootstrap.js dynamically fetches skill names/content from GitHub.
- bootstrap.js writes fetched skills into ~/.agents and ~/.claude.
- bootstrap-shared.js modifies project CLAUDE.md and AGENTS.md.
- Bundled SKILL.md contains coercive agent-continuation instructions.
- Downloaded WASM is verified only against remotely fetched hashes.
Evidence against
- package.json has no npm lifecycle hooks.
- Activation is through the explicit gm-plugkit CLI/API path.
- No credential harvesting or direct exfiltration found.
- Release artifact downloads use SHA-256 comparison.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcebootstrap-shared.jsView file
5const os = require('os');
L6: const { spawnSync } = require('child_process');
L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');
High
Child Process
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5bootstrap.jsView file
7const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L37:
L38: const wrapperDir = __dirname;
L39:
...
L44: try {
L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L46: if (ownPkg && ownPkg.version) {
...
L167: const dir = gmToolsDir();
L168: const names = process.platform === 'win32'
L169: ? ['agentplug-runner.exe']
Critical
Download Execute
Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js
L7: const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L37:
L38: const wrapperDir = __dirname;
L39:
...
L44: try {
L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L46: if (ownPkg && ownPkg.version) {
...
L167: const dir = gmToolsDir();
L168: const names = process.platform === 'win32'
L169: ? ['agentplug-runner.exe']
Findings
3 Critical1 High3 Medium3 Low
CriticalDownload Executebootstrap.js
CriticalTrigger Reachable Dangerous Capabilitybootstrap.js
CriticalPrevious Version Dangerous Deltabootstrap.js
HighChild Processbootstrap-shared.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gm-plugkit@2.0.2465.
See all versions of gm-plugkit for other recorded verdicts.
- Review the evidence and your use of gm-plugkit@2.0.2465 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.