gm-plugkit@2.0.2506
Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has no install hook and no confirmed credential theft, so a block is not warranted. Its explicit CLI nevertheless mutates broad agent instruction surfaces and executes remotely delivered native code.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the gm-plugkit CLI (for example via bun x/npx).
Impact
Can alter future agent instructions and execute a remotely supplied runner in the invoked project context.
Mechanism
Remote skill provisioning plus downloaded native daemon execution
AI rationale
The package has no install hook and no confirmed credential theft, so a block is not warranted. Its explicit CLI nevertheless mutates broad agent instruction surfaces and executes remotely delivered native code.
Evidence
package.jsonindex.jscli.jsbootstrap.jsbootstrap-shared.js<project>/CLAUDE.md<project>/AGENTS.md<project>/.gm/next-step.md<project>/.gm/instructions/~/.agents/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md~/.gm-tools/agentplug-runner
Network endpoints5
api.github.com/repos/AnEntrypoint/agentplug-bin/releases/latestgithub.com/AnEntrypoint/agentplug-bin/releases/download/<tag>/api.github.com/repos/AnEntrypoint/gm/contents/skills?ref=mainraw.githubusercontent.com/AnEntrypoint/gm/main/skills/<skill>/SKILL.mdregistry.npmjs.org/gm-plugkit/latest
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- bootstrap.js writes project CLAUDE.md and AGENTS.md wiring.
- bootstrap.js refreshes ~/.agents/skills and ~/.claude/skills.
- CLI downloads and executes agentplug-runner as a daemon.
- Remote skills are fetched from the moving main branch.
Evidence against
- package.json has no lifecycle scripts.
- index.js only exports functions; import has no bootstrap.
- No credential harvesting or data-exfiltration code found.
- Network use is limited to declared GitHub/npm release and update sources.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcebootstrap-shared.jsView file
5const os = require('os');
L6: const { spawnSync } = require('child_process');
L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');
High
Child Process
Package source references child process execution.
bootstrap-shared.jsView on unpkg · L5bootstrap.jsView file
7const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L37:
L38: const wrapperDir = __dirname;
L39:
...
L44: try {
L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L46: if (ownPkg && ownPkg.version) {
...
L167: const dir = gmToolsDir();
L168: const names = process.platform === 'win32'
L169: ? ['agentplug-runner.exe']
Critical
Download Execute
Source downloads or fetches remote code and executes it.
bootstrap.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js
L7: const crypto = require('crypto');
L8: const { spawn, spawnSync } = require('child_process');
L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
...
L37:
L38: const wrapperDir = __dirname;
L39:
...
L44: try {
L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
L46: if (ownPkg && ownPkg.version) {
...
L167: const dir = gmToolsDir();
L168: const names = process.platform === 'win32'
L169: ? ['agentplug-runner.exe']
Findings
2 Critical1 High3 Medium3 Low
CriticalDownload Executebootstrap.js
CriticalTrigger Reachable Dangerous Capabilitybootstrap.js
HighChild Processbootstrap-shared.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gm-plugkit@2.0.2506.
See all versions of gm-plugkit for other recorded verdicts.
- Review the evidence and your use of gm-plugkit@2.0.2506 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.