registry / mcp-efficiency-engine / 0.1.14

mcp-efficiency-engine@0.1.14

Motor de orquestacion capability-centric v2 para agentes MCP con optimizacion always-on.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently scaffolds an AI-agent/tooling control surface into the consumer project and changes its Git hook configuration. The resulting hook persists after installation and runs package-supplied code on commits.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation, including non-interactive installs.

Impact

Unconsented modification of a foreign project’s AI-agent configuration and future commit execution path.

Mechanism

host-project MCP/agent configuration injection plus Git hook persistence

Policy narrative

On npm postinstall, the package uses the install working directory as a target, copies its agent instructions, MCP configuration, scripts, and Git hook files into that foreign project, then configures core.hooksPath. This occurs automatically in non-interactive installs and establishes package-controlled commands and a post-commit execution path without an explicit user setup command.

Rationale

Direct source inspection confirms unconsented postinstall mutation of a consumer project’s broad AI-agent control surface and persistent Git configuration. The overwrite guard does not mitigate creation of absent control files.

Evidence

package.jsonbin/install-host.jsscripts/setup/install-project-hooks.ps1.vscode/mcp.json.githooks/post-commitscripts/ops/post-commit-refresh.ps1AGENTS.md.github/.githooks/repo-registry/repos.yml

mcp-efficiency-engine@0.1.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code