Loading npm security reports…

marketing-cli@0.7.0: AI-agent control-surface risk | LPM Firewall

registry / marketing-cli / 0.7.0

marketing-cli@0.7.0

Agent-native marketing playbook: 76 skills, 6 research/review agents, brand memory that compounds, plus a local Studio dashboard (beta). One install, then /cmo in Claude Code walks you through a 4-question setup wizard. CLI for the agent, Studio for the h

AI Security Review

scanned 54m ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically modifies Claude Code's user-wide skills and agents directories. It also performs a second global npm installation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm i -g marketing-cli

Impact

Unconsented persistent AI-agent instruction injection and installation of additional code.

Mechanism

postinstall writes ~/.claude control-surface files and executes npm

Policy narrative

The package's npm postinstall hook runs during global installation, resolves the user's home (including under sudo), and copies its bundled skills and agents into Claude Code's user-wide control directories without an explicit setup command. The same hook then executes a second global npm install. This is an unconsented install-time mutation of a foreign, broad AI-agent control surface.

Rationale

Source confirms concrete postinstall persistence into ~/.claude/skills and ~/.claude/agents plus runtime npm installation. This meets the install-control-surface block policy.

Evidence

package.jsonscripts/postinstall.cjsskillsagents~/.claude/skills~/.claude/agents

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with false-positive risk.

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

1049// src/core/skills.ts L1050: import { spawnSync } from "node:child_process"; L1051: import { join as join4, dirname as dirname3 } from "node:path";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1049

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.js: var GITHUB_REPO_URL = "https://github.com/MoizIbnYousaf/marketing-cli", GITHUB_REPO_ISSUES_URL, GITHUB_REPO_BLOB_MAIN; 1. What email/newsletter tool is available? (gws, Resend, Loops) if (auth.base_default !== undefined && (typeof auth.base_default !== "string" || !auth.base_default.startsWith("https://"))) { if (typeof mcp.default_url !== "string" || !mcp.default_url.startsWith("https://")) { { name: "bun", required: true, installHint: "curl -fsSL https://bun.sh/install | bash" }, import { readFile as readFile3, writeFile as writeFile2, mkdir as mkdir5, stat as stat2 } from "node:fs/promises"; await writeFile2(projectManifestPath, JSON.string

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.jsView on unpkg

23data, L24: exitCode: 0, L25: ...display !== undefined && { display }, ... L202: } L203: return { ok: true, data: filtered }; L204: }, findPivotKey = (obj, fields) => { ... L342: // src/constants.ts L343: var GITHUB_REPO_URL = "https://github.com/MoizIbnYousaf/marketing-cli", GITHUB_REPO_ISSUES_URL, GITHUB_REPO_BLOB_MAIN; L344: var init_constants = __esm(() => { ... L378: try { L379: const parsed = JSON.parse(raw); L380: if (typeof parsed === "object" && parsed !== null) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli.jsView on unpkg · L23

skills/mktg-x/scripts/lib/cookies/util/exec.jsView file

48// On Windows, some tools are `.cmd`/`.bat` wrappers and won't exec directly. L49: // We fall back to `cmd.exe /c` and quote args ourselves. L50: const quoted = [cmd, ...args.map(cmdQuote)].join(' ');

High

Shell

Package source references shell execution.

skills/mktg-x/scripts/lib/cookies/util/exec.jsView on unpkg · L48

scripts/postinstall.cjsView file

111} catch (err) { L112: log(`⚠️ chown failed for ${target}: ${err && err.message ? err.message : String(err)}. You may need to run: sudo chown -R $(whoami) ~/.claude`); L113: } ... L116: const copyFilePreservingMode = (source, target) => { L117: fs.mkdirSync(path.dirname(target), { recursive: true }); L118: fs.copyFileSync(source, target); L119: const mode = fs.statSync(source).mode; ... L141: const manifest = readJson(sk[redacted]); L142: const targetRoot = path.join(home, ".claude", "skills"); L143: let installed = 0; L144: L145: fs.mkdirSync(targetRoot, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L111

217// automatically alongside marketing-cli so users running L218: // `npm i -g marketing-cli` get a working setup in one shot. Skip with L219: // MKTG_SKIP_OPTIONAL_DEPS=1. Tests skip via MKTG_TEST_REAL_HOME (which ... L232: ) { L233: const { execSync } = require("node:child_process"); L234: const optionalDeps = [

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.cjsView on unpkg · L217

skills/remotion-best-practices/scripts/check-upstream.shView file

•path = skills/remotion-best-practices/scripts/check-upstream.sh kind = build_helper sizeBytes = 5619 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/remotion-best-practices/scripts/check-upstream.shView on unpkg

studio/components/settings/brand-health-section.tsxView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

studio/components/settings/brand-health-section.tsxView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 42-82json

42 "studio/CHANGELOG.md",

43 "studio/CLAUDE.md",

44 "studio/CODE_OF_CONDUCT.md",

45 "studio/CONTRIBUTING.md",

46 "studio/LICENSE",

47 "studio/README.md",

48 "studio/SECURITY.md",

49 "LICENSE",

50 "README.md",

51 "CONTRIBUTING.md",

52 "SECURITY.md",

53 "CODE_OF_CONDUCT.md"

54 ],

55 "scripts": {

56 "build": "bun build src/cli.ts --outdir dist --target node",

57 "dev": "bun run src/cli.ts",

58 "test": "bun test tests",

59 "test:studio": "bun run --cwd studio test",

60 "typecheck": "bun x tsc --noEmit",

61 "doctor": "bun run src/cli.ts doctor",

62 "postinstall": "node ./scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "prepack": "node ./scripts/derive-counts.cjs && node ./scripts/prepack-strip-workspaces.cjs",

64 "postpack": "node ./scripts/postpack-restore.cjs",

65 "prepublishOnly": "bun run build"

66 },

67 "keywords": [

68 "marketing",

69 "cli",

70 "agent",

71 "ai",

72 "playbook",

73 "claude-code",

74 "claude-code-skills",

75 "agent-skills",

76 "marketing-automation",

77 "brand-voice",

78 "seo",

79 "cmo",

80 "skills-sh"

81 ],

82 "author": "Moiz Ibn Yousaf",

dist/cli.jsView file

1049// src/core/skills.ts L1050: import { spawnSync } from "node:child_process"; L1051: import { join as join4, dirname as dirname3 } from "node:path";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1049

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.js: var GITHUB_REPO_URL = "https://github.com/MoizIbnYousaf/marketing-cli", GITHUB_REPO_ISSUES_URL, GITHUB_REPO_BLOB_MAIN; 1. What email/newsletter tool is available? (gws, Resend, Loops) if (auth.base_default !== undefined && (typeof auth.base_default !== "string" || !auth.base_default.startsWith("https://"))) { if (typeof mcp.default_url !== "string" || !mcp.default_url.startsWith("https://")) { { name: "bun", required: true, installHint: "curl -fsSL https://bun.sh/install | bash" }, import { readFile as readFile3, writeFile as writeFile2, mkdir as mkdir5, stat as stat2 } from "node:fs/promises"; await writeFile2(projectManifestPath, JSON.string

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.jsView on unpkg

23data, L24: exitCode: 0, L25: ...display !== undefined && { display }, ... L202: } L203: return { ok: true, data: filtered }; L204: }, findPivotKey = (obj, fields) => { ... L342: // src/constants.ts L343: var GITHUB_REPO_URL = "https://github.com/MoizIbnYousaf/marketing-cli", GITHUB_REPO_ISSUES_URL, GITHUB_REPO_BLOB_MAIN; L344: var init_constants = __esm(() => { ... L378: try { L379: const parsed = JSON.parse(raw); L380: if (typeof parsed === "object" && parsed !== null) {

skills/mktg-x/scripts/lib/cookies/util/exec.jsView file

Lines 28-68javascript

28 }, timeoutMs);

29 timer.unref?.();

30 child.on('error', (error) => {

31 clearTimeout(timer);

32 resolve({

33 code:

scripts/postinstall.cjsView file

Lines 91-131javascript

91 return { home: parts[5], uid, gid, viaSudo: true };

92 }

93 }

94 } catch {

95 // Fall through to graceful failure below.

96 }

97

98 return { home:

skills/remotion-best-practices/scripts/check-upstream.shView file

•path = skills/remotion-best-practices/scripts/check-upstream.sh kind = build_helper sizeBytes = 5619 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/remotion-best-practices/scripts/check-upstream.shView on unpkg

studio/components/settings/brand-health-section.tsxView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

studio/components/settings/brand-health-section.tsxView on unpkg

Lines 197-237javascript

197 if (viaSudo) {

198 log(

199 `ℹ️ mktg postinstall: detected sudo install — installing to ${home}/.claude/ (your real home, not ${os.homedir()}).`,

200 );

201 }

202

203 const skills = installSkills(home);

204 const agents = installAgents(home);

205

206 if (viaSudo) {

207 chownRecursive(skills.targetRoot, uid, gid);

208 chownRecursive(agents.targetRoot, uid, gid);

209 // Also chown the parent .claude dir so subsequent writes by the real user

210 // don't trip over a root-owned ancestor.

211 chownRecursive(path.join(home, ".claude"), uid, gid);

212 }

213

214 log(`mktg postinstall: installed ${skills.installed} skills and ${agents.installed} agents for Claude Code.`);

215

216 // Optional sibling CLIs that pair with bundled skills. These install

217 // automatically alongside marketing-cli so users running

218 // `npm i -g marketing-cli` get a working setup in one shot. Skip with

219 // MKTG_SKIP_OPTIONAL_DEPS=1. Tests skip via MKTG_TEST_REAL_HOME (which

220 // signals a controlled test environment — running real npm i during tests

221 // would hit network timeouts and modify the user's global npm install).

222 // Each install is fail-soft — a network or permission error here must NOT

223 // break the marketing-cli install itself.

224 // Tests set MKTG_POSTINSTALL_QUIET=1 to silence the postinstall — we use

225 // the same signal to skip optional CLI installs because tests run in

226 // sandboxed temp homes where running real `npm i -g` would either modify

227 // the user's global install or hit network timeouts.

228 if (

229 process.env.MKTG_SKIP_OPTIONAL_DEPS !== "1" &&

230 !process.env.MKTG_TEST_REAL_HOME &&

231 process.env.MKTG_POSTINSTALL_QUIET !== "1"

232 ) {

233 const { execSync } = require("node:child_process");

234 const optionalDeps = [

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.cjsView on unpkg · L217

235 {

236 pkg: "@higgsfield/cli",

237 purpose: "AI image + video generation (powers higgsfield-generate / soul-id / product-photoshoot skills)",