registry / AI-agent control-surface risk / pinchtab
pinchtab
Browser control API for AI agents
This report shows the evidence for pinchtab@0.15.2. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has concrete postinstall code that writes its bundled instructions into several unrelated AI-agent skill directories. Safety-oriented skill content does not remove the unconsented cross-agent control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm postinstall during installation or update
Impact
Installed AI agents can load package-provided instructions from their control surfaces.
Mechanism
Automatic cross-agent skill-directory creation and file copying
Policy narrative
On npm installation, the postinstall hook downloads the package executable and then synchronizes the bundled Pinchtab skill. The synchronizer detects existing skill parents for Claude, OpenClaw, Cursor, Windsurf, and Codex, creates a pinchtab subdirectory where needed, and copies its files there. This is an unconsented install-time mutation of multiple foreign AI-agent control surfaces.
AI rationale
The package has concrete postinstall code that writes its bundled instructions into several unrelated AI-agent skill directories. Safety-oriented skill content does not remove the unconsented cross-agent control-surface mutation.
Evidence
package.jsondist/src/postinstall.jsscripts/sync-skills.jsskills/pinchtab/SKILL.mddist/src/download.jsscripts/postinstall.jsskills/pinchtab$HOME/.claude/skills/pinchtab$HOME/.openclaw/workspace/.agents/skills/pinchtab$HOME/.cursor/skills/pinchtab$HOME/.windsurf/skills/pinchtab$HOME/.codex/skills/pinchtab
Network endpoints1
github.com/pinchtab/pinchtab/releases/download/v${version}/${asset}
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The install hook runs automatically after npm installation.
- The install code invokes skill synchronization without user approval.
- The synchronizer targets five separate AI-agent skill locations.
- It creates target directories and copies the bundled skill files into them.
Evidence against
- The bundled skill text tells agents to treat web content as untrusted and requires approval for consequential actions.
- The downloaded executable is checked against a SHA-256 value before it is installed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/download.jsView file
37exports.ensureBinary = ensureBinary;
L38: const fs = __importStar(require("fs"));
L39: const path = __importStar(require("path"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/download.jsView on unpkg · L37Findings
1 Critical2 High5 Medium4 Low
CriticalAi Agent Control Hijackscripts/sync-skills.js
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/src/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/download.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to pinchtab@0.15.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing pinchtab@0.15.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.