registry / AI-agent control-surface risk / onemanagency
onemanagency
Sistema de execução de projetos via IA. OneManAgency - funciona em qualquer IDE e adapta-se a qualquer projeto.
This report shows the evidence for onemanagency@4.2.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. No exfiltration is needed for this verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation of onemanagency@4.2.0
Impact
Unconsented agent behavior changes and remote third-party code introduction.
Mechanism
postinstall propagation into detected AI-agent control surfaces
Policy narrative
Installing the package triggers build/postinstall.js without a user command. It invokes installAll, which detects numerous AI-agent configuration homes and overwrites this package's skills into their skill directories; it additionally installs global npm packages and clones mutable external repositories by default.
AI rationale
This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. No exfiltration is needed for this verdict.
Evidence
package.jsonbuild/postinstall.jsbuild/installer.jsbin/oma.js~/.oma/~/.claude/skills/~/.codex/skills/~/.cursor/skills/~/.gemini/skills/~/.gemini/antigravity/skills/
Network endpoints3
github.com/voltagent/awesome-design-md.gitgithub.com/coreyhaines31/marketingskills.gitgithub.com/anthropics/skills.git
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- build/postinstall.js calls installAll during npm install.
- build/installer.js copies skills into detected ~/.claude, ~/.codex, ~/.cursor, ~/.gemini and other agent directories.
- Installer also installs global npm CLIs and clones mutable external Git repositories.
Evidence against
- No credential harvesting or exfiltration code found in inspected runtime files.
- CLI's explicit install command offers --no-external, but postinstall does not use it.
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node build/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node build/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/oma.jsView file
21const path = require('path');
L22: const { execSync } = require('child_process');
L23: const os = require('os');
High
build/installer.js
Findings
1 Critical4 High3 Medium4 Low
CriticalAi Agent Control Hijackbuild/installer.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oma.js
HighShell
HighRuntime Package Installbuild/installer.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Build Helperinstall/install.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to onemanagency@4.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing onemanagency@4.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.