Loading npm security reports…

pantheon-cli@0.2.123: AI-agent control-surface risk | LPM Firewall

registry / pantheon-cli / 0.2.123

pantheon-cli@0.2.123

Carry agent conscience between AI coding agents. Hand off a conversation in one agent, resume it in another.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically changes multiple unrelated AI-agent control surfaces. It creates command and skill files and can register a local Pantheon MCP server without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global installation runs postinstall.

Impact

Future Codex, Claude, and Cursor sessions can load Pantheon-provided instructions and invoke its MCP process.

Mechanism

Postinstall launches the CLI to write cross-client MCP configuration, skills, and commands.

Policy narrative

Installing this package globally triggers postinstall, which starts its bundled CLI. With no existing Pantheon configuration, the CLI still creates skills and slash-command files for Codex, Claude, Cursor, and generic agent directories. With a configuration present, it also modifies MCP configuration for several AI clients. These changes activate outside the package command path and cause future agent sessions to load package-controlled instructions and a Pantheon MCP process.

AI rationale

The package has a concrete automatic postinstall chain that broadly mutates foreign AI-agent control surfaces, including when unconfigured. This meets the install-hook abuse blocking boundary despite the absence of a downloaded payload.

Evidence

package.jsonpostinstall.mjsdist/pantheon.mjs~/.agents/skills/pantheon/SKILL.md~/.codex/skills/pantheon/SKILL.md~/.codex/config.toml~/.cursor/commands/*.md~/.cursor/mcp.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pantheon.mjsView file

39838lstatSync, L39839: mkdirSync as mkdirSync2, L39840: openSync as openSync2, ... L39846: statSync as statSync2, L39847: writeFileSync as writeFileSync2, L39848: appendFileSync L39849: } from "node:fs"; ... L39865: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39866: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39867: const reported = client?.trim(); ... L40019: function codexRoot() { L40020: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39838

39849} from "node:fs"; L39850: import { execFileSync, spawnSync } from "node:child_process"; L39851: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39849

2953sourceCode = this.opts.code.process(sourceCode, sch); L2954: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2955: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pantheon.mjsView on unpkg · L2953

postinstall.mjsView file

1Cross-file remote execution chain: postinstall.mjs spawns dist/pantheon.mjs; helper contains network access plus dynamic code execution. L1: import { spawnSync } from "node:child_process"; L2: import { fileURLToPath } from "node:url"; ... L4: const globalInstall = ["1", "true"].includes( L5: (process.env.npm[redacted] || "").toLowerCase(), L6: ); ... L16: if (result.error) { L17: process.stderr.write( L18: `pantheon: installed, but automatic agent refresh could not start — ${result.error.message}\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

postinstall.mjsView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

Lines 21-43json

21 "handoff",

22 "cursor",

23 "claude",

24 "codex"

25 ],

26 "dependencies": {},

27 "devDependencies": {

28 "@modelcontextprotocol/sdk": "^1.12.1",

29 "@types/node": "^20",

30 "esbuild": "^0.28.2",

31 "tsx": "^4.20.3",

32 "typescript": "^5",

33 "zod": "^3.25.67",

34 "@pantheon/core": "0.1.0",

35 "@pantheon/mcp": "0.1.0"

36 },

37 "scripts": {

38 "start": "tsx src/index.ts",

39 "test": "tsx --test test/*.test.ts",

40 "build": "node scripts/build.mjs",

41 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

dist/pantheon.mjsView file

39838lstatSync, L39839: mkdirSync as mkdirSync2, L39840: openSync as openSync2, ... L39846: statSync as statSync2, L39847: writeFileSync as writeFileSync2, L39848: appendFileSync L39849: } from "node:fs"; ... L39865: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39866: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39867: const reported = client?.trim(); ... L40019: function codexRoot() { L40020: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39838

39849} from "node:fs"; L39850: import { execFileSync, spawnSync } from "node:child_process"; L39851: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39849

2953sourceCode = this.opts.code.process(sourceCode, sch); L2954: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2955: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pantheon.mjsView on unpkg · L2953

postinstall.mjsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { fileURLToPath } from "node:url";

3

4const globalInstall = ["1", "true"].includes(