registry / AI-agent control-surface risk / idea-gauntlet
idea-gauntlet
Stress-test product ideas with adversarial agents, synthetic users, and court-style critique.
This report shows the evidence for idea-gauntlet@0.5.1. 7 of 10 known versions are blocked or flagged. The newest version, 0.7.0, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking policy irrespective of the absence of confirmed credential theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
Can change behavior and available agent workflows across installed AI coding tools.
Mechanism
automatic writes to foreign AI-agent configuration surfaces
Policy narrative
Installing the package runs a postinstall handler that detects global Claude, Codex, and Cursor directories. It generates and writes agent instruction files, Codex configuration, Cursor rules, and a Claude MCP entry that launches this package's CLI. This mutates foreign AI-agent control surfaces as a side effect of installation rather than through an explicit user setup command.
AI rationale
Direct inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking policy irrespective of the absence of confirmed credential theft.
Evidence
package.jsondist/postinstall.jsdist/chunk-B7LL55D5.jsAGENTS.md.codex/config.toml.claude/commands/gauntlet-quick.md.cursor/rules/idea-gauntlet-quick.mdcclaude_desktop_config.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- npm postinstall executes dist/postinstall.js.
- Postinstall calls globalSetup in install mode without user action.
- Setup detects and targets global Claude, Codex, and Cursor configuration directories.
- It creates agent instructions/configuration and writes planned actions to those paths.
Evidence against
- Existing differing files are left unchanged unless force is set.
- No credential exfiltration or remote payload execution was confirmed in the inspected lifecycle path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli/index.js:
import { createInterface } from "readline/promises";
console.log("\n\u26A0 No API key or provider configured.");
console.log(" 2) Configure API key now");
baseUrl: options.baseUrl,
const rl = (await import("readline/promises")).createInterface({ input: process.stdin, output: process.stdout });
const key = await rl.question("Enter API key: ");
baseUrl: options.baseUrl,
baseUrl: options.baseUrl,
Findings
2 Critical4 High3 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalAi Agent Control Hijackdist/chunk-B7LL55D5.js
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cli/index.js
HighEntrypoint Foreign Package Code Overwritedist/chunk-HT6SXACV.js
HighCloud Metadata Accessdist/chunk-A6JBYWQ5.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to idea-gauntlet@0.5.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing idea-gauntlet@0.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
10 known versions0.7.0latestSuspicious—WarnUnder ReviewAug 26, 2026, 3:12 AM0.5.1shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 3:16 AM0.5.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 3:03 AM0.3.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 18, 2026, 2:24 PM