registry / gm-plugkit / 2.0.2533

gm-plugkit@2.0.2533

Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A user CLI invocation provisions and refreshes global AI-agent skill files, rewrites project agent instruction entrypoints, and launches a detached spool daemon. The installed instructions direct future agents to follow daemon-provided imperatives.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the gm-plugkit CLI or calling ensureReady

Impact

Controls future agent behavior across ~/.agents, ~/.claude, and the current project; executes a remotely supplied native runner.

Mechanism

Remote-updatable AI-agent control-surface provisioning plus daemon bootstrap

Policy narrative

On explicit CLI use, the package writes or replaces global skills for multiple agent platforms, alters project instruction-loading files, and starts a detached native spool daemon. Skill content instructs agents to obtain future actions from that daemon. The package also refreshes skills from a mutable GitHub main branch and downloads the runner from the latest release; the checksum is fetched from the same release source.

Rationale

The package has no install hook, but its normal runtime path performs broad, remote-updatable AI-agent control-surface mutation and executes a detached downloaded native runner. This is a concrete agent-control chain beyond a narrow package-owned setup.

Evidence

package.jsoncli.jsbootstrap.jsbootstrap-shared.jsSKILL.md~/.agents/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md<project>/CLAUDE.md<project>/AGENTS.md

gm-plugkit@2.0.2533

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code