registry / peaks-loop / 3.0.0

peaks-loop@3.0.0

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Install-time lifecycle mutates AI-agent control surfaces in user home directories. It installs package-supplied skills, output styles, and Claude agent prompts without requiring an explicit user command beyond npm install.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install postinstall

Impact

AI IDEs may load package-supplied instructions or agent prompts from user-global control directories after install.

Mechanism

unconsented AI-agent skill/agent/control-file installation

Attack narrative

On npm postinstall, scripts/install-skills.mjs executes automatically. It fans out package-controlled skill symlinks across multiple AI IDE home directories, copies output styles, installs a Claude sub-agent prompt, writes managed markers/config, and can dispatch an upgrade command for detected legacy projects. This is a lifecycle mutation of AI-agent control surfaces rather than a user-invoked CLI setup step.

Rationale

The package is an AI workflow CLI, but the install lifecycle performs broad, user-global AI agent/control-surface writes by default. Under the firewall policy this is unconsented lifecycle AI-agent control-surface mutation, so it should be blocked despite lack of credential exfiltration. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonscripts/install-skills.mjsagents/karpathy-reviewer.mdoutput-styles/peaks-skill-swarm.mdskills/peaks-solo/SKILL.md~/.claude/skills/*~/.trae/skills/*~/.trae-cn/skills/*~/.codex/skills/*~/.cursor/skills/*~/.qoder/skills/*~/.tongyi-lingma/skills/*~/.hermes/skills/*~/.openclaw/skills/*~/.claude/output-styles/*~/.claude/agents/karpathy-reviewer.md~/.peaks/config.json

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

package.json defines postinstall: node ./scripts/install-skills.mjs
scripts/install-skills.mjs runs on lifecycle and calls installBundledSkillsForAllPlatforms, installBundledOutputStyles, installBundledAgentsForAllPlatforms
postinstall symlinks package skills into ~/.claude, ~/.trae, ~/.codex, ~/.cursor, ~/.qoder, ~/.tongyi-lingma and related skills dirs
postinstall copies agent prompt agents/karpathy-reviewer.md into ~/.claude/agents with managed marker files
postinstall writes ~/.peaks/config.json and may spawn peaks upgrade for detected 1.x projects

Evidence against

No credential harvesting or external exfiltration found in inspected hot files
Network URLs in inspected package are documentation/readme links or user-invoked npx playwright-mcp@latest runtime behavior
Child process usage is mostly CLI orchestration after user commands, except the postinstall auto-upgrade spawn

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 437 file(s), 2.84 MB of source, external domains: api.anthropic.com, api.example.com, api.openai.com, github.com, gitlab.com, reactbits.dev, www.google.com, www.pulsemcp.com

Source & flagged code

6 flagged

package.jsonView file

Lines 29-69json

29 "scripts/sync-version.mjs",

30 "scripts/install-skills.mjs",

31 "scripts/watch.mjs",

32 "skills/**",

33 "!skills/**/test-prompts.json",

34 "!skills/**/.DS_Store",

35 "output-styles/**",

36 "agents/**",

37 "schemas/*.json",

38 ".claude-plugin/**",

39 "README.md",

40 "README-en.md",

41 "CHANGELOG.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.json",

46 "prepack": "npm run build",

47 "prepublishOnly": "node scripts/prepublish-build.mjs",

48 "prepublish": "node ./scripts/sync-version.mjs",

49 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "predev": "node ./scripts/sync-version.mjs",

51 "dev": "tsx src/cli/index.ts",

52 "dev:watch": "node ./scripts/watch.mjs",

53 "pretest": "node ./scripts/sync-version.mjs",

54 "test": "node ./scripts/lint/silent-warning-detector.mjs && vitest run",

55 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

56 "test:race": "vitest run --no-file-parallelism tests/unit/g8-shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",

57 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

58 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

59 "test:coverage": "vitest run --coverage",

60 "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

61 "pretest:coverage": "node ./scripts/pretest-coverage.mjs",

62 "schema:generate": "node scripts/generate-context-schema.mjs",

63 "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

64 "mut:run": "peaks mut run --project . --out mut-report.json",

65 "mut:scan": "peaks mut asserts --in mut-report.json",

66 "audit:prose-ratio": "peaks audit prose-ratio --project ."

67 },

68 "engines": {

69 "node": ">=20.0.0"

dist/src/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

3 return new Promise((resolve,

dist/src/services/upgrade/upgrade-service.jsView file

Lines 131-171javascript

131function read1xVersion(cwd) {

132 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

133 if (home.length === 0)

134

dist/src/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

5import

dist/src/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

dist/src/services/upgrade/upgrade-service.jsView file

151// npm install postinstall creates `peaks` → `peaks.sh` on L152: // Windows). cmd.exe (the default Windows shell) cannot run L153: // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L151

dist/src/cli/commands/loop-eval-commands.jsView file

478// eslint-disable-next-line @typescript-eslint/no-var-requires L479: const fs = require('node:fs'); L480: let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

scripts/install-skills.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L291: fchmodSync(fd, 0o600); L292: writeFileSync(fd, content, 'utf8'); L293: const writeFd = fd; ... L320: fchmodSync(fd, 0o600); L321: writeFileSync(fd, content, 'utf8'); L322: const writeFd = fd; ... L372: * cannot import the TS service at runtime. The dispatch: L373: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L374: * `.tongyi-lingma` in the project root in that insertion order Payload evidence from schemas/mcp-install-spec.schema.json: L1: { L2: "$schema": "https://json-schema.org/draft/2020-12/schema", L3: "title": "Peaks MCP Install Spec", ... L25: "items": { "type": "string" }, L26: "description": "Required env var names. Values are sourced from process.env at runtime and written as ${VAR} placeholders into settings.json." L27: }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

dist/src/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-cli is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

Findings

1 Critical4 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/shared/process.js

HighShelldist/src/services/upgrade/upgrade-service.js

HighRuntime Package Installdist/src/cli/commands/playwright-commands.js

MediumDynamic Requiredist/src/cli/commands/loop-eval-commands.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 29-69json

29 "scripts/sync-version.mjs",

30 "scripts/install-skills.mjs",

31 "scripts/watch.mjs",

32 "skills/**",

33 "!skills/**/test-prompts.json",

34 "!skills/**/.DS_Store",

35 "output-styles/**",

36 "agents/**",

37 "schemas/*.json",

38 ".claude-plugin/**",

39 "README.md",

40 "README-en.md",

41 "CHANGELOG.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.json",

46 "prepack": "npm run build",

47 "prepublishOnly": "node scripts/prepublish-build.mjs",

48 "prepublish": "node ./scripts/sync-version.mjs",

49 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "predev": "node ./scripts/sync-version.mjs",

51 "dev": "tsx src/cli/index.ts",

52 "dev:watch": "node ./scripts/watch.mjs",

53 "pretest": "node ./scripts/sync-version.mjs",

54 "test": "node ./scripts/lint/silent-warning-detector.mjs && vitest run",

55 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

57 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

58 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

59 "test:coverage": "vitest run --coverage",

60 "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

61 "pretest:coverage": "node ./scripts/pretest-coverage.mjs",

62 "schema:generate": "node scripts/generate-context-schema.mjs",

63 "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

64 "mut:run": "peaks mut run --project . --out mut-report.json",

65 "mut:scan": "peaks mut asserts --in mut-report.json",

66 "audit:prose-ratio": "peaks audit prose-ratio --project ."

67 },

68 "engines": {

69 "node": ">=20.0.0"

dist/src/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

3 return new Promise((resolve,

dist/src/services/upgrade/upgrade-service.jsView file

Lines 131-171javascript

131function read1xVersion(cwd) {

132 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

133 if (home.length === 0)

134

dist/src/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

5import

dist/src/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with