registry / AI-agent control-surface risk / oh-my-taiyiforge

oh-my-taiyiforge

TaiyiForge — OpenCode 插件 + Claude/Codex/Cursor 共用 taiyi-* 九阶段研发工作流

This report shows the evidence for oh-my-taiyiforge@1.1.0, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The source establishes an unconsented postinstall chain that changes multiple global AI-agent control surfaces and pulls additional tooling. This meets the blocking policy regardless of the absence of confirmed credential exfiltration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Persistent global AI-agent instructions, MCP registration, skills/plugins, and project wrapper changes.

Mechanism

automatic multi-agent configuration and dependency installation

Policy narrative

On ordinary npm installation, postinstall builds then calls runInstall with all agent targets unless an opt-out variable is set. The installer writes global agent skills, Codex developer instructions and AGENTS.md, global MCP configurations, and other agent configuration; it also defaults to installing third-party dependencies, including a Git clone. These unconsented install-time writes affect broad, foreign AI-agent control surfaces.

AI rationale

Evidence

package.jsonpostinstall.mjsdist/install/run.jsdist/install/paths.jsdist/install/sync-codex-config.jsdist/install/sync-user-mcp.jsdist/install/third-party-deps.jsdist/install/codex-agents.jsdist/install/sync-project-wrapper.jsdist/install/sync-consumer-scripts.js

Network endpoints1

github.com/obra/superpowers.git

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall.mjs automatically.
postinstall.mjs invokes runInstall unless explicitly disabled.
dist/install/run.js defaults postinstall targets to all supported agents.
dist/install/sync-codex-config.js overwrites Codex developer_instructions.
dist/install/sync-user-mcp.js adds global Codex and Claude MCP entries.
dist/install/third-party-deps.js installs/clones third-party agent tooling by default.

Evidence against

Postinstall can be disabled only through opt-out environment variables.
No credential-harvesting or direct exfiltration code was confirmed in inspected installer sources.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 261 file(s), 1.32 MB of source, external domains: api.openai.com, github.com

Source & flagged code

8 flagged

package.jsonView file

Lines 35-75json

35 "taiyi-forge": "./scripts/taiyi-forge.mjs",

36 "taiyi-forge-install": "./dist/cli/install-cli.js"

37 },

38 "repository": {

39 "type": "git",

40 "url": "https://github.com/Dong90/oh-my-taiyiforge.git"

41 },

42 "keywords": [

43 "opencode",

44 "opencode-plugin",

45 "taiyiforge",

46 "claude-code",

47 "codex",

48 "cursor",

49 "ai-workflow",

50 "agent-skills"

51 ],

52 "scripts": {

53 "build": "tsc",

54 "prepare": "npm run build",

55 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "vitest run",

57 "test:py": "python -m pytest tests/ -v",

58 "test:watch": "vitest",

59 "taiyi": "node --import tsx src/cli/taiyi.ts",

60 "install:all": "node dist/cli/install-cli.js --all",

61 "dogfood": "node scripts/dogfood-e2e.mjs",

62 "walkthrough": "node scripts/walkthrough.mjs",

63 "ci:verify": "node scripts/ci.mjs verify",

64 "ci:platforms": "node scripts/ci.mjs platform opencode && node scripts/ci.mjs platform claude && node scripts/ci.mjs platform codex && node scripts/ci.mjs platform cursor",

65 "prepublishOnly": "npm run build && node scripts/sync-hbs-templates.mjs && npm run check:docs && npm test",

66 "taiyi:doctor": "taiyi doctor --strict-workspace",

67 "taiyi:verify": "taiyi verify",

68 "taiyi:smoke": "node -e \"const{spawnSync}=require('child_process');const r=spawnSync(process.execPath,['dist/cli/taiyi.js','--version']);process.exit(r.status)\"",

69 "probe:fullflow": "node scripts/probes/taiyi-fullflow-probe.mjs",

70 "probe:postfix": "node scripts/probes/post-fix-regression.mjs",

71 "generate:docs": "node scripts/generate-docs.mjs",

72 "check:docs": "node scripts/generate-docs.mjs --check",

73 "check:links": "node scripts/check-md-links.mjs",

74 "check:state-schema": "node scripts/check-state-schema.mjs",

75 "check:docs-sync": "node scripts/check-docs-sync.mjs"

dist/install/third-party-deps.jsView file

Lines 1-22javascript

1import fs from "node:fs";

2import path from "node:path";

3import { spawnSync } from "node:child_process";

4import { homeDir } from "./paths.js";

dist/core/dev-complete.jsView file

55try { L56: _execFileSync(cmd, { cwd, shell: true, stdio: "pipe", encoding: "utf8", timeout: 60_000 }); L57: return { code: 0 };

High

Shell

Package source references shell execution.

dist/core/dev-complete.jsView on unpkg · L55

dist/core/test-plan-sync.jsView file

64// eslint-disable-next-line @typescript-eslint/no-require-imports L65: const { safeWriteFileSync } = require("./file-writer.js"); L66: safeWriteFileSync(jsonPath, JSON.stringify({ ...parsed.data, test_plan: next }, null, 2) + "\n", { skipRedact: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/test-plan-sync.jsView on unpkg · L64

dist/install/run.jsView file

Lines 95-135javascript

95 opencodeNpmSpec: "local",

96 installDeps,

97 };

98 }

99 const hasOpencode = targets.includes("opencode");

100 return

dist/core/file-writer.jsView file

Lines 41-74javascript

41 const tmp = `${filePath}.tmp.${process.pid}`;

42 fs.writeFileSync(tmp, cleaned, options?.encoding ?? "utf8");

43 fs.renameSync(tmp, filePath);

scripts/install-skills.shView file

•path = scripts/install-skills.sh kind = build_helper sizeBytes = 1300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skills.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/third-party-deps.jsView file

2import path from "node:path"; L3: import { spawnSync } from "node:child_process"; L4: import { homeDir } from "./paths.js";

High

Child Process

Package source references child process execution.

dist/install/third-party-deps.jsView on unpkg · L2

Findings

1 Critical4 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/install/run.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/install/third-party-deps.js

HighShelldist/core/dev-complete.js

HighRuntime Package Installdist/core/file-writer.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/core/test-plan-sync.js

MediumEnvironment Vars

MediumShips Build Helperscripts/install-skills.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to oh-my-taiyiforge@1.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing oh-my-taiyiforge@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-03 14:32:19.390Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.1.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 13, 2026, 11:19 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code