registry / AI-agent control-surface risk / perfetto-analyzer
perfetto-analyzer
AI skill for Android performance analysis using Perfetto — works with Claude Code, Cursor, GitHub Copilot, Codex, Antigravity and Devin
This report shows the evidence for perfetto-analyzer@1.0.4. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms unconsented postinstall mutation of broad/foreign AI-agent control surfaces, which meets the block policy even though the shipped skill content is mostly package-aligned and no exfiltration was found. The malicious verdict is based on the install-time control-surface write, not scanner labels. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / npm global install running postinstall
Impact
Installs package-supplied instructions and scripts into multiple assistants without explicit user command or consent during npm install.
Mechanism
unprompted recursive copy of package skill files into AI-agent skill directories
Policy narrative
On npm install, package.json runs bin/cli.js install --postinstall. That code silently iterates over Claude Code, GitHub Copilot, Cursor, Antigravity, Codex, and Devin directories and recursively copies the package's skill/ tree into each agent's skills folder, creating directories as needed. This gives the package install step control over multiple AI-agent extension surfaces without an explicit user setup command.
AI rationale
Source inspection confirms unconsented postinstall mutation of broad/foreign AI-agent control surfaces, which meets the block policy even though the shipped skill content is mostly package-aligned and no exfiltration was found. The malicious verdict is based on the install-time control-surface write, not scanner labels. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsonbin/cli.jsskill/SKILL.mdskill/scripts/collect_trace.pyskill/scripts/parse_perfetto_pb.pyskill/scripts/analyze_metrics.pyskill/scripts/generate_report.py~/.claude/skills/perfetto-analyzer~/.github/copilot/skills/perfetto-analyzer~/.cursor/skills/perfetto-analyzer~/.antigravity/skills/perfetto-analyzer~/.codex/skills/perfetto-analyzer~/.devin/skills/perfetto-analyzer
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 93.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json defines postinstall: node bin/cli.js install --postinstall
- bin/cli.js postinstall path calls install(true) without prompting
- bin/cli.js copies package skill/ into six AI-agent skill directories under user home
- Targets broad/foreign agent control surfaces: .claude, .github/copilot, .cursor, .antigravity, .codex, .devin
Evidence against
- No network or exfiltration endpoints found in inspected source
- Skill content is aligned with Android Perfetto analysis
- Python helpers are user-invoked from the installed skill, not npm install-time
- No credential/env harvesting, eval/vm/Function, native binary loading, or remote payload fetch found
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/cli.js install --postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/cli.js install --postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/cli.jsView file
10Install-time AI-agent control hijack evidence:
L10: const AGENTS = [
L11: { name: "Claude Code", dir: path.join(os.homedir(), ".claude", "skills") },
L12: { name: "GitHub Copilot", dir: path.join(os.homedir(), ".github", "copilot", "skills") },
...
L14: { name: "Antigravity", dir: path.join(os.homedir(), ".antigravity", "skills") },
L15: { name: "Codex", dir: path.join(os.homedir(), ".codex", "skills") },
L16: { name: "Devin", dir: path.join(os.homedir(), ".devin", "skills") },
...
L19: function copyDir(src, dest) {
L20: fs.mkdirSync(dest, { recursive: true });
L21: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L26: } else {
L27: fs.copyFileSync(srcPath, destPath);
L28: }
Payload evidence from skill/SKILL.md:
L143:
L1
Critical
Ai Agent Control Hijack
Install-time source drops package-supplied AI-agent/MCP control files or instructions.
bin/cli.jsView on unpkg · L10skill/scripts/parse_perfetto_pb.pyView file
•path = skill/scripts/parse_perfetto_pb.py
kind = build_helper
sizeBytes = 16663
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skill/scripts/parse_perfetto_pb.pyView on unpkgFindings
1 Critical1 High3 Medium2 Low
CriticalAi Agent Control Hijackbin/cli.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Build Helperskill/scripts/parse_perfetto_pb.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to perfetto-analyzer@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing perfetto-analyzer@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
4 known versions1.0.4latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 9, 2026, 11:23 PM1.0.3MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 9, 2026, 11:05 PM1.0.1MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 9, 2026, 10:49 PM1.0.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 9, 2026, 9:31 PM