Loading npm security reports…

payloadcms-seo-cli@0.1.0: AI-agent control-surface risk | LPM Firewall

registry / payloadcms-seo-cli / 0.1.0

payloadcms-seo-cli@0.1.0

A PayloadCMS Content SEO CLI Tool for AI LLM Agents to do SEO

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs package-authored AI-agent instructions into the consuming project. It targets Cursor, Claude, and AGENTS.md by default.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation executes `node dist/cli.js setup --silent`.

Impact

Alters foreign project AI-agent control surfaces without an explicit setup command or consent.

Mechanism

silent postinstall mutation of AI-agent rule and instruction files

Policy narrative

On installation, the postinstall invokes setup with --silent. With no target selector, setup writes the package's Cursor rule and Claude skill and merges its AGENTS.md block into the consumer project. Silent mode bypasses the normal differing-file safeguard for copied targets. The injected instruction tells agents to route writes and scans through this package, modifying multiple unrelated AI-agent control surfaces without an explicit user setup action.

Rationale

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the block boundary. The user-configured Payload REST client does not mitigate the install-time behavior.

Evidence

package.jsondist/cli.jsrules/AGENTS.mdrules/cursor/payloadcms-seo-cli.mdcrules/claude/payloadcms-seo-cli/SKILL.md.cursor/rules/payloadcms-seo-cli.mdc.claude/skills/payloadcms-seo-cli/SKILL.mdAGENTS.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli.js setup --silent

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

46"scripts": { "build": "tsdown", "prepublishOnly": "npm run build", "postinstall": "node dist/cli.js setup --silent", "dev": "tsx src/cli.ts",

High

Suspicious Lifecycle Evidence

package.json runs `setup --silent` automatically at postinstall.

package.jsonView on unpkg · L46

•scripts.postinstall = node dist/cli.js setup --silent

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

3import { dirname, join, resolve } from "node:path"; L4: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L5: import { fileURLToPath } from "node:url"; ... L10: const SETUP_FLAG_YES = "--yes"; L11: const SETUP_CURSOR_RULES_DIR = ".cursor/rules"; L12: const SETUP_CURSOR_RULE_FILENAME = "payloadcms-seo-cli.mdc"; L13: const SETUP_CLAUDE_SKILLS_DIR = ".claude/skills"; L14: const SETUP_CLAUDE_SKILL_DIR_NAME = "payloadcms-seo-cli"; L15: const SETUP_CLAUDE_SKILL_FILENAME = "SKILL.md"; L16: const SETUP_AGENTS_FILENAME = "AGENTS.md"; L17: const SETUP_AGENTS_SENTINEL_START = ""; ... L21: const SETUP_CLAUDE_SOURCE_DIR = "rules/claude/payloadcms-seo-cli";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli.jsView on unpkg · L3

63function collectTargets(params) { const { options } = params; const selected = []; if (options.cursor === true) selected.push(SETUP_TARGET_CURSOR); if (options.claude === true) selected.push(SETUP_TARGET_CLAUDE); if (options.agents === true) selected.push(SETUP_TARGET_AGENTS); if (selected.length === 0) return [ SETUP_TARGET_CURSOR, SETUP_TARGET_CLAUDE, SETUP_TARGET_AGENTS ]; return selected;

High

Ai Review Evidence

With no target flags, setup selects Cursor, Claude, and AGENTS targets.

dist/cli.jsView on unpkg · L63

Source & flagged code

5 flagged

package.jsonView file

Lines 26-69json

26 "jscpd",

27 "aho-corasick",

28 "cursor",

29 "claude",

30 "codex",

31 "agent-skills"

32 ],

33 "main": "./dist/index.js",

34 "module": "./dist/index.js",

35 "types": "./dist/index.d.ts",

36 "bin": {

37 "payloadcms-seo-cli": "./dist/cli.js"

38 },

39 "files": [

40 "dist",

41 "rules"

42 ],

43 "engines": {

44 "node": ">=20"

45 },

46 "scripts": {

47 "build": "tsdown",

48 "prepublishOnly": "npm run build",

49 "postinstall": "node dist/cli.js setup --silent",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "dev": "tsx src/cli.ts",

High

Suspicious Lifecycle Evidence

package.json runs `setup --silent` automatically at postinstall.

package.jsonView on unpkg · L46

51 "start": "node dist/cli.js",

52 "lint": "eslint .",

53 "lint:fix": "eslint . --fix",

54 "scip:index": "scip-typescript index --output tools/scip/index.scip",

55 "scip:stats": "tools/scip/scip stats --from tools/scip/index.scip",

56 "scip:json": "tools/scip/scip print --json tools/scip/index.scip",

57 "scip:convert": "tools/scip/scip expt-convert --output tools/scip/scip.db tools/scip/index.scip",

58 "scip:sqlite": "sqlite3 tools/scip/scip.db",

59 "scip:snapshot": "tools/scip/scip snapshot --from tools/scip/index.scip --to tools/scip/scip-snapshot --strict=false",

60 "ast-grep:scan": "ast-grep scan",

61 "ast-grep:test": "ast-grep test --skip-snapshot-tests",

62 "ast-grep:debug": "ast-grep scan -r tools/ast-grep/rules/typescript/ts-param-trailing-comma.yml",

63 "knip": "knip --config ./knip.json"

64 },

65 "devDependencies": {

66 "@ast-grep/cli": "^0.45.1",

67 "@eslint/eslintrc": "^3.3.0",

68 "@eslint/js": "^10.0.0",

69 "@sourcegraph/scip-typescript": "^0.4.0",

dist/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { a as printCaughtError, d as toUnknownError, f as FILE_UTF8_ENCODING, h as FLAG_HELP, m as FLAG_FORCE, n as PACKAGE_JSON_FILE_NAME, p as FLAG_DRY_RUN, r as PACKAGE_JSON_UTF8_ENCODING, t as runCli } from "./run-cli-BzZqC631.js";