Loading npm security reports…

oh-my-taiyiforge@1.1.0: AI-agent control-surface risk | LPM Firewall

registry / oh-my-taiyiforge / 1.1.0

oh-my-taiyiforge@1.1.0

TaiyiForge — OpenCode 插件 + Claude/Codex/Cursor 共用 taiyi-* 九阶段研发工作流

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates global Codex, Claude, Cursor, and OpenCode agent-control surfaces without an explicit setup command. It also installs additional third-party tooling by default.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Persistent global AI-agent instructions, MCP registration, skills/plugins, and project wrapper changes.

Mechanism

automatic multi-agent configuration and dependency installation

Policy narrative

On ordinary npm installation, postinstall builds then calls runInstall with all agent targets unless an opt-out variable is set. The installer writes global agent skills, Codex developer instructions and AGENTS.md, global MCP configurations, and other agent configuration; it also defaults to installing third-party dependencies, including a Git clone. These unconsented install-time writes affect broad, foreign AI-agent control surfaces.

Rationale

The source establishes an unconsented postinstall chain that changes multiple global AI-agent control surfaces and pulls additional tooling. This meets the blocking policy regardless of the absence of confirmed credential exfiltration.

Evidence

package.jsonpostinstall.mjsdist/install/run.jsdist/install/paths.jsdist/install/sync-codex-config.jsdist/install/sync-user-mcp.jsdist/install/third-party-deps.jsdist/install/codex-agents.jsdist/install/sync-project-wrapper.js

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/third-party-deps.jsView file

2import path from "node:path"; L3: import { spawnSync } from "node:child_process"; L4: import { homeDir } from "./paths.js";

High

Child Process

Package source references child process execution.

dist/install/third-party-deps.jsView on unpkg · L2

dist/core/dev-complete.jsView file

55try { L56: _execFileSync(cmd, { cwd, shell: true, stdio: "pipe", encoding: "utf8", timeout: 60_000 }); L57: return { code: 0 };

High

Shell

Package source references shell execution.

dist/core/dev-complete.jsView on unpkg · L55

dist/core/test-plan-sync.jsView file

64// eslint-disable-next-line @typescript-eslint/no-require-imports L65: const { safeWriteFileSync } = require("./file-writer.js"); L66: safeWriteFileSync(jsonPath, JSON.stringify({ ...parsed.data, test_plan: next }, null, 2) + "\n", { skipRedact: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/test-plan-sync.jsView on unpkg · L64

dist/install/run.jsView file

115const home = process.env.HOME || process.env.USERPROFILE || ""; L116: const global = path.join(home, ".config", "opencode", "opencode.json"); L117: // 项目内配置优先（避免污染全局配置） ... L125: if (targets.includes("opencode")) { L126: lines.push(` OpenCode → opencode.json: "plugin": ["${PLUGIN_NAME}"]`); L127: lines.push(` OpenCode → ${dirs.opencode}/taiyi-*`); L128: lines.push(` OpenCode → ${defaultOpenCodeCommandsDir()}/taiyi-*.md`); ... L130: if (targets.includes("codex")) { L131: lines.push(` Codex → ${dirs.codex}/taiyi-* + AGENTS.md + config.toml ($taiyi-preflight)`); L132: lines.push(` Codex → ${defaultCodexPromptsDir()}/taiyi-*.md + ~/.codex/mcp.json`); L133: } L134: if (targets.includes("claude")) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install/run.jsView on unpkg · L115

dist/core/file-writer.jsView file

61else { L62: spawnSync("npx", ["--yes", formatter, "--write", "--prose-wrap", "always", filePath], { L63: encoding: "utf8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/file-writer.jsView on unpkg · L61

scripts/install-skills.shView file

•path = scripts/install-skills.sh kind = build_helper sizeBytes = 1300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skills.shView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 35-75json

35 "taiyi-forge": "./scripts/taiyi-forge.mjs",

36 "taiyi-forge-install": "./dist/cli/install-cli.js"

37 },

38 "repository": {

39 "type": "git",

40 "url": "https://github.com/Dong90/oh-my-taiyiforge.git"

41 },

42 "keywords": [

43 "opencode",

44 "opencode-plugin",

45 "taiyiforge",

46 "claude-code",

47 "codex",

48 "cursor",

49 "ai-workflow",

50 "agent-skills"

51 ],

52 "scripts": {

53 "build": "tsc",

54 "prepare": "npm run build",

55 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "test": "vitest run",

57 "test:py": "python -m pytest tests/ -v",

58 "test:watch": "vitest",

59 "taiyi": "node --import tsx src/cli/taiyi.ts",

60 "install:all": "node dist/cli/install-cli.js --all",

61 "dogfood": "node scripts/dogfood-e2e.mjs",

62 "walkthrough": "node scripts/walkthrough.mjs",

63 "ci:verify": "node scripts/ci.mjs verify",

64 "ci:platforms": "node scripts/ci.mjs platform opencode && node scripts/ci.mjs platform claude && node scripts/ci.mjs platform codex && node scripts/ci.mjs platform cursor",

65 "prepublishOnly": "npm run build && node scripts/sync-hbs-templates.mjs && npm run check:docs && npm test",

66 "taiyi:doctor": "taiyi doctor --strict-workspace",

67 "taiyi:verify": "taiyi verify",

68 "taiyi:smoke": "node -e \"const{spawnSync}=require('child_process');const r=spawnSync(process.execPath,['dist/cli/taiyi.js','--version']);process.exit(r.status)\"",

69 "probe:fullflow": "node scripts/probes/taiyi-fullflow-probe.mjs",

70 "probe:postfix": "node scripts/probes/post-fix-regression.mjs",

71 "generate:docs": "node scripts/generate-docs.mjs",

72 "check:docs": "node scripts/generate-docs.mjs --check",

73 "check:links": "node scripts/check-md-links.mjs",

74 "check:state-schema": "node scripts/check-state-schema.mjs",

75 "check:docs-sync": "node scripts/check-docs-sync.mjs"

dist/install/third-party-deps.jsView file

Lines 1-22javascript

1import fs from "node:fs";

2import path from "node:path";

3import { spawnSync } from "node:child_process";

4import { homeDir } from "./paths.js";

dist/core/dev-complete.jsView file

Lines 35-64javascript

35 try {

36 const r = exec(cmd, cwd);

37 if (r.code !== 0) {

38 return {

39 passed:

dist/core/test-plan-sync.jsView file

Lines 44-71javascript

44 catch (e) {

45 const err = e;

46 stdout = err.stdout ?? "";

47 }

48 // 解析 vitest json reporter stdout（--json 输出到 stdout）

49

dist/install/run.jsView file

Lines 95-135javascript

95 opencodeNpmSpec: "local",

96 installDeps,

97 };

98 }

99 const hasOpencode = targets.includes("opencode");

100 return

dist/core/file-writer.jsView file

Lines 41-74javascript

41 const tmp = `${filePath}.tmp.${process.pid}`;

42 fs.writeFileSync(tmp, cleaned, options?.encoding ?? "utf8");

43 fs.renameSync(tmp, filePath);

scripts/install-skills.shView file

•path = scripts/install-skills.sh kind = build_helper sizeBytes = 1300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skills.shView on unpkg