registry / gm-plugkit / 2.0.2504

gm-plugkit@2.0.2504

Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete, user-triggered first-party AI-agent extension lifecycle with remote native-code execution and instruction wiring. It meets the warn boundary, not the block boundary, because there is no npm lifecycle-triggered foreign/broad control-surface mutation or source-confirmed exfiltration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User invokes `gm-plugkit`/`bun x gm-plugkit`.

Impact

Can persist vendor-controlled skills and project agent instructions, then run a downloaded spool daemon.

Mechanism

remote runner bootstrap plus agent instruction/control-surface wiring

AI rationale

Evidence

package.jsoncli.jsbootstrap.jsbootstrap-shared.jsbootstrap-wasm-core.jsSKILL.md.gm/next-step.mdCLAUDE.mdAGENTS.md~/.agents/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md~/.gm-tools/agentplug-runner

Network endpoints3

api.github.com/repos/AnEntrypoint/agentplug-bin/releases/latestgithub.com/AnEntrypoint/agentplug-bin/releases/download/${tag}raw.githubusercontent.com/AnEntrypoint/gm/main/skills/${skillName}/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bootstrap.js` downloads and executes a native `agentplug-runner` daemon after an explicit CLI invocation.
`bootstrap-shared.js` creates/edits project `CLAUDE.md` and `AGENTS.md` to load `.gm/next-step.md`.
The injected next-step file directs agents to follow spool-provided imperatives.
`ensureSkillMdFresh` fetches skills from GitHub and writes them into `~/.agents/skills` and `~/.claude/skills`.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
All observed bootstrap, project wiring, downloads, and daemon starts are reached from the user-invoked CLI.
No source evidence of credential harvesting, secret exfiltration, stealthy remote shell execution, or destructive project-wide deletion.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

3 flagged

bootstrap-shared.jsView file

Lines 1-25javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const os = require('os');

6const { spawnSync } = require('child_process');

7const { pidAlive, sha256OfFileSync } = require('./gm-process');

High

Child Process

Package source references child process execution.

bootstrap-shared.jsView on unpkg · L5

10const LOCK_STALE_MS = 30 * 60 * 1000;

11const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;

13function obsEvent(subsystem, event, fields) {

14 if (process.env.GM_LOG_DISABLE) return;

15 try {

16 const root = process.env.GM_LOG_DIR || path.join(os.homedir(), '.claude', 'gm-log');

17 const day = new Date().toISOString().slice(0, 10);

18 const dir = path.join(root, day);

19 fs.mkdirSync(dir, { recursive: true });

20 const line = JSON.stringify({

21 ts: new Date().toISOString(),

22 sub: subsystem,

23 event,

24 pid: process.pid,

25 sess: process.env.CLAUDE_SESSION_ID || process.env.GM_SESSION_ID || '',

bootstrap.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Source & flagged code

3 flagged · loading source

bootstrap-shared.jsView file

5const os = require('os'); L6: const { spawnSync } = require('child_process'); L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');

High

Child Process

Package source references child process execution.

bootstrap-shared.jsView on unpkg · L5

bootstrap.jsView file

7const crypto = require('crypto'); L8: const { spawn, spawnSync } = require('child_process'); L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process'); ... L37: L38: const wrapperDir = __dirname; L39: ... L44: try { L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L46: if (ownPkg && ownPkg.version) { ... L167: const dir = gmToolsDir(); L168: const names = process.platform === 'win32' L169: ? ['agentplug-runner.exe']

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bootstrap.jsView on unpkg · L7

7Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js L7: const crypto = require('crypto'); L8: const { spawn, spawnSync } = require('child_process'); L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process'); ... L37: L38: const wrapperDir = __dirname; L39: ... L44: try { L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L46: if (ownPkg && ownPkg.version) { ... L167: const dir = gmToolsDir(); L168: const names = process.platform === 'win32' L169: ? ['agentplug-runner.exe']

Findings

2 Critical1 High3 Medium3 Low

CriticalDownload Executebootstrap.js

CriticalTrigger Reachable Dangerous Capabilitybootstrap.js

HighChild Processbootstrap-shared.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gm-plugkit@2.0.2504.

See all versions of gm-plugkit for other recorded verdicts.

Review the evidence and your use of gm-plugkit@2.0.2504 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-06 12:46:24.527Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code