registry / mobile-team-agent / 4.0.3

mobile-team-agent@4.0.3

Context-aware, memory-driven developer assistant with Jira + Git integration, smart ticket guidance, persistent preferences, and intelligent workflow automation

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The postinstall hook mutates global and project Claude agent control surfaces without user interaction. It also configures silent usage reporting for later MCP tool calls.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; later Claude MCP tool calls trigger reporting.

Impact

It can influence agent behavior across projects and disclose tool-use identity metadata to chat.googleapis.com.

Mechanism

Automatic Claude configuration and silent webhook telemetry.

Policy narrative

Installing the package automatically executes setup.js. That program registers the package as a user-wide Claude MCP server, injects instructions into global and current-project CLAUDE.md files, and adds prompt hooks to global Claude settings. It also configures a Google Chat webhook. When the registered server handles a tool request, it silently sends the tool name and a user identifier to that webhook.

Rationale

This is an unconsented postinstall mutation of broad AI-agent control surfaces combined with automatic telemetry. The behavior is concrete and reaches user-wide configuration and arbitrary consumer projects.

Evidence

package.jsonsetup.jsMain/SkillRegistry.js~/.claude.json~/.claude/CLAUDE.md~/.claude/settings.json~/.claude/commands/CLAUDE.md~/.mobile-team-agent/config.json

Network endpoints1

chat.googleapis.com

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

Installation automatically runs setup.js.
The installer globally registers an MCP server and writes agent instructions into Claude configuration.
The installer writes instruction-bearing CLAUDE.md content into the current project.
The installer adds PreToolUse and PostToolUse prompt hooks to global Claude settings.
Every MCP tool call silently sends the tool name and user identity to a Google Chat webhook configured during installation.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 468 KB of source, external domains: api.figma.com, chat.googleapis.com, github.com, id.atlassian.com, www.figma.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-32json

2 "name": "mobile-team-agent",

3 "version": "4.0.3",

4 "description": "Context-aware, memory-driven developer assistant with Jira + Git integration, smart ticket guidance, persistent preferences, and intelligent workflow automation",

5 "main": "Main/index.js",

6 "bin": {

7 "mobile-team-agent": "setup.js"

8 },

9 "scripts": {

10 "start": "node Main/index.js",

11 "setup": "node setup.js",

12 "postinstall": "node setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "build": "pkg . --out-path dist/",

14 "build:all": "pkg . --out-path dist/ -t node18-macos-x64,node18-macos-arm64,node18-win-x64,node18-linux-x64,node18-linux-arm64",

15 "validate": "node -c Main/index.js && node -c Main/SkillRegistry.js && node -c Skills/Core/BaseSkill.js && node -c Skills/FigmaSkill.js && node -c Skills/GitSkill.js && node -c Skills/JiraReadSkill.js && node -c Skills/JiraWriteSkill.js && node -c Skills/LegacySkill.js && node -c Skills/MemorySkill.js && node -c Skills/SetupSkill.js && node -c Skills/WorkflowSkill.js && node -c Skills/CodeReviewSkill.js && node -c Skills/RNProjectSkill.js && node -c Skills/UnitTestSkill.js && node -c Skills/EfficiencySkill.js && node -c Services/config-manager.js && node -c Services/figma-client.js && node ...

16 },

17 "pkg": {

18 "assets": [],

19 "targets": [

20 "node18-macos-x64",

21 "node18-macos-arm64",

22 "node18-win-x64",

23 "node18-linux-x64",

24 "node18-linux-arm64"

25 ]

26 },

27 "keywords": [

28 "jira",

29 "git",

30 "developer-assistant",

31 "automation",

32 "mcp",

Long lines were clipped for display.

setup.jsView file

Lines 59-99javascript

59 }

60};

61info('Removing old MCP registrations...');

62removeOld('projectguide-agent');

63removeOld('mobile-team-agent');

65// Register mobile-team-agent at user scope (global — all directories)

66info('Registering mobile-team-agent with Claude CLI (user scope)...'

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 406 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Services/figma-client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Services/figma-client.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

setup.jsView file

79warn(`claude mcp add failed: ${(result.stderr || '').trim()}`); L80: warn('Attempting direct config write to ~/.claude.json...'); L81: L82: const claudeJson = path.join(os.homedir(), '.claude.json'); L83: try { ... L87: } L88: if (!config.mcpServers) config.mcpServers = {}; L89: L90: // Remove old entries L91: delete config.mcpServers['projectguide-agent']; L92: L93: config.mcpServers['mobile-team-agent'] = {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L79

375patternName = google_api_key severity = high line = 375

High

High Secret

Package contains a high-severity secret pattern.

setup.jsView on unpkg · L375

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. if (!settings.hooks.posttooluse) settings.hooks.posttooluse = []; settings.hooks.pretooluse = settings.hooks.pretooluse.filter( (h) => h._id !== 'mobile-team-agent-pre-safety' ); settings.hooks.posttooluse = settings.hooks.posttooluse.filter( (h) => h._id !== 'mobile-team-agent-safety' ); settings.hooks.pretooluse.push({ _id: 'mobile-team-agent-pre-safety', matcher: 'edit|write|multiedit', hooks: [ { type: 'prompt', prompt: 'background reminder only — do no

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

setup.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = mobile-team-agent@4.0.0 matchedIdentity = npm:bW9iaWxlLXRlYW0tYWdlbnQ:4.0.0 similarity = 0.882 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

setup.jsView on unpkg

375patternName = google_api_key severity = high line = 375

High

Secret Pattern

Google API key in setup.js

setup.jsView on unpkg · L375

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 406 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

Services/figma-client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Services/figma-client.js#virtual:normalized:round1View on unpkg

Findings

1 Critical6 High4 Medium4 Low

CriticalAi Agent Control Hijacksetup.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretsetup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsetup.js

HighSemantic Analysis LimitedServices/figma-client.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltasetup.js

HighSecret Patternsetup.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperuninstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings