registry / mcp-efficiency-engine / 0.1.17

mcp-efficiency-engine@0.1.17

Motor de orquestacion capability-centric v2 para agentes MCP con optimizacion always-on.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consuming project’s AI-agent configuration surface and removes existing GitHub agent/skill directories. It also installs a post-commit hook into host Git configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of this package, including normal noninteractive installs

Impact

Unconsented control over host MCP/Copilot instructions and persistent execution after commits.

Mechanism

host-project scaffold, AI config replacement, deletion, and Git-hook persistence

Policy narrative

On npm postinstall, the package targets the consumer working directory, copies its .vscode MCP configuration and GitHub instruction material, and deletes pre-existing .github/agents and .github/skills. In noninteractive installs it additionally configures core.hooksPath to its copied hook directory. This is unconsented install-time mutation of a foreign host’s AI-agent and execution-control surfaces.

Rationale

The lifecycle behavior is concrete and package-controlled, not a scanner-only inference. It meets the firewall block rule for unconsented postinstall mutation of broad foreign AI-agent control surfaces.

Evidence

package.jsonbin/install-host.js.vscode/mcp.jsonscripts/setup/install-project-hooks.ps1.githooks/post-commitscripts/ops/post-commit-refresh.ps1.github/agents.github/skills.github/.githooks/git core.hooksPath

mcp-efficiency-engine@0.1.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code