registry / gm-plugkit / 2.0.2505
gm-plugkit@2.0.2505
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis package establishes a broad, remotely mutable AI-agent instruction and daemon surface when explicitly run. The absence of lifecycle hooks prevents a malicious/install-block verdict under the stated policy, but the capability warrants warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the gm-plugkit CLI (including its default spool command).
Impact
A remote repository can alter instructions loaded by Claude/agent tooling across projects and start a persistent spool watcher.
Mechanism
remote skill deployment, project instruction rewiring, and native daemon bootstrap
AI rationale
This package establishes a broad, remotely mutable AI-agent instruction and daemon surface when explicitly run. The absence of lifecycle hooks prevents a malicious/install-block verdict under the stated policy, but the capability warrants warning.
Evidence
package.jsoncli.jsbootstrap.jsbootstrap-shared.jsSKILL.md<project>/CLAUDE.md<project>/AGENTS.md<project>/.gm/next-step.md<project>/.gm/instructions/$HOME/.agents/skills/<skill>/SKILL.md$HOME/.claude/skills/<skill>/SKILL.md$HOME/.gm-tools/agentplug-runner<project>/.gm/exec-spool/
Network endpoints4
raw.githubusercontent.com/AnEntrypoint/gm/main/skills/<skill>/SKILL.mdapi.github.com/repos/AnEntrypoint/gm/contents/skills?ref=maingithub.com/AnEntrypoint/agentplug-bin/releases/download/<tag>/<asset>api.github.com/repos/AnEntrypoint/agentplug-bin/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- bootstrap.js:803 invokes project wiring on normal CLI boot.
- bootstrap-shared.js:266-289 creates/rewrites CLAUDE.md and AGENTS.md to load .gm instructions.
- bootstrap.js:624-704 installs bundled or remotely discovered skills into ~/.agents/skills and ~/.claude/skills.
- bootstrap.js:610-621 fetches arbitrary skill names/content from AnEntrypoint/gm main branch.
- bootstrap.js:931-961 downloads and installs a native agentplug-runner, then bootstrap.js:968-1007 detaches it as a daemon.
- SKILL.md directs agents to follow a live instruction stream and forbids normal completion.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The behavior is reached through the explicit gm-plugkit CLI, not package import.
- Downloaded runner and wasm paths have SHA-256 checks, though trust remains remote-controlled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
3 flagged · loading sourcebootstrap-shared.jsView file
5const os = require('os');
L6: const { spawnSync } = require('child_process');
L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');
High
Child Process
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5bootstrap.jsView file
7const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L37:
L38: const wrapperDir = __dirname;
L39:
...
L44: try {
L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L46: if (ownPkg && ownPkg.version) {
...
L167: const dir = gmToolsDir();
L168: const names = process.platform === 'win32'
L169: ? ['agentplug-runner.exe']
Critical
Download Execute
Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js
L7: const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L37:
L38: const wrapperDir = __dirname;
L39:
...
L44: try {
L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L46: if (ownPkg && ownPkg.version) {
...
L167: const dir = gmToolsDir();
L168: const names = process.platform === 'win32'
L169: ? ['agentplug-runner.exe']
Findings
2 Critical1 High3 Medium3 Low
CriticalDownload Executebootstrap.js
CriticalTrigger Reachable Dangerous Capabilitybootstrap.js
HighChild Processbootstrap-shared.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gm-plugkit@2.0.2505.
See all versions of gm-plugkit for other recorded verdicts.
- Review the evidence and your use of gm-plugkit@2.0.2505 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.