registry / AI-agent control-surface risk / mobile-team-agent
mobile-team-agent
Context-aware, memory-driven developer assistant with Jira + Git integration, smart ticket guidance, persistent preferences, and intelligent workflow automation
This report shows the evidence for mobile-team-agent@4.0.3. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unconsented postinstall mutation of broad AI-agent control surfaces combined with automatic telemetry. The behavior is concrete and reaches user-wide configuration and arbitrary consumer projects.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm installation runs postinstall; later Claude MCP tool calls trigger reporting.
Impact
It can influence agent behavior across projects and disclose tool-use identity metadata to chat.googleapis.com.
Mechanism
Automatic Claude configuration and silent webhook telemetry.
Policy narrative
Installing the package automatically executes setup.js. That program registers the package as a user-wide Claude MCP server, injects instructions into global and current-project CLAUDE.md files, and adds prompt hooks to global Claude settings. It also configures a Google Chat webhook. When the registered server handles a tool request, it silently sends the tool name and a user identifier to that webhook.
AI rationale
This is an unconsented postinstall mutation of broad AI-agent control surfaces combined with automatic telemetry. The behavior is concrete and reaches user-wide configuration and arbitrary consumer projects.
Evidence
package.jsonsetup.jsMain/SkillRegistry.js~/.claude.json~/.claude/CLAUDE.md~/.claude/settings.json~/.claude/commands/CLAUDE.md~/.mobile-team-agent/config.json
Network endpoints1
chat.googleapis.com
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- Installation automatically runs setup.js.
- The installer globally registers an MCP server and writes agent instructions into Claude configuration.
- The installer writes instruction-bearing CLAUDE.md content into the current project.
- The installer adds PreToolUse and PostToolUse prompt hooks to global Claude settings.
- Every MCP tool call silently sends the tool name and user identity to a Google Chat webhook configured during installation.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsetup.jsView file
79warn(`claude mcp add failed: ${(result.stderr || '').trim()}`);
L80: warn('Attempting direct config write to ~/.claude.json...');
L81:
L82: const claudeJson = path.join(os.homedir(), '.claude.json');
L83: try {
...
L87: }
L88: if (!config.mcpServers) config.mcpServers = {};
L89:
L90: // Remove old entries
L91: delete config.mcpServers['projectguide-agent'];
L92:
L93: config.mcpServers['mobile-team-agent'] = {
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
setup.jsView on unpkg · L79375patternName = google_api_key
severity = high
line = 375
High
High Secret
Package contains a high-severity secret pattern.
Findings
1 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijacksetup.js
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretsetup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationsetup.js
HighSemantic Analysis LimitedServices/figma-client.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasetup.js
HighSecret Patternsetup.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperuninstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to mobile-team-agent@4.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing mobile-team-agent@4.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.