registry / AI-agent control-surface risk / pitch-skills
pitch-skills
Agent skills for founding pitches: Priestley CAPSTONE enrollment and investor diligence. Works with Cursor, Claude Code, Codex, and ChatGPT/VS Code Agent.
This report shows the evidence for pitch-skills@1.4.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concrete postinstall chain that overwrites multiple consumer-project AI-agent instruction locations and runs a broad sync command. This meets the blocking policy for unconsented lifecycle mutation of foreign/broad AI-agent control surfaces.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
`npm install pitch-skills` in a consumer project
Impact
Project-local Cursor, Claude, Codex, and universal agent instructions are deleted/replaced without an explicit user command.
Mechanism
postinstall copies skills into foreign agent directories and runs broad npx sync
Policy narrative
At npm postinstall, the package determines the consumer project root, removes existing per-skill directories, and copies its instruction files into universal, Cursor, Claude, and Codex skill locations. It also invokes `npx skills experimental_sync` with `-a '*'`. This is unconsented lifecycle-time mutation of broad, foreign AI-agent control surfaces; its benign-looking pitch content does not remove the install-time control-hijack behavior.
AI rationale
Source inspection confirms a concrete postinstall chain that overwrites multiple consumer-project AI-agent instruction locations and runs a broad sync command. This meets the blocking policy for unconsented lifecycle mutation of foreign/broad AI-agent control surfaces.
Evidence
package.jsonscripts/install.jsscripts/mirror-agents.js.cursor-plugin/plugin.json.claude-plugin/plugin.jsonskills/pitch-capstone/SKILL.md<projectRoot>/package.json<projectRoot>/.agents/skills/pitch-capstone<projectRoot>/.agents/skills/pitch-diligence<projectRoot>/.cursor/skills/pitch-capstone<projectRoot>/.claude/skills/pitch-capstone<projectRoot>/.codex/skills/pitch-capstone
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- `package.json` runs `scripts/install.js` on `postinstall`.
- `scripts/install.js` locates the consuming project via `INIT_CWD`/cwd.
- Postinstall deletes and replaces four project agent-skill paths.
- It writes `.agents`, `.cursor`, `.claude`, and `.codex` control surfaces.
- It invokes `npx skills experimental_sync -y -a '*'` during installation.
Evidence against
- Skill contents are pitch and investor-diligence guidance, not credential collection.
- No hard-coded exfiltration endpoint, secret harvesting, eval, or payload loader found.
- Plugin manifests only declare the package's `skills` directory.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.jsView file
7Install-time AI-agent control hijack evidence:
L7: * .cursor/skills/ — Cursor
L8: * .claude/skills/ — Claude Code
L9: * .codex/skills/ — Codex CLI (alt path)
L10: *
...
L24: '.cursor/skills',
L25: '.claude/skills',
L26: '.codex/skills',
L27: ]
...
L82: function copyDir(src, dest) {
L83: fs.mkdirSync(dest, { recursive: true })
L84: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L87: if (entry.isDirectory()) copyDir(from, to)
Payload evidence from skills/pitch-capstone/SKILL.md:
L9: stress-tests, and killer questions — only after the CAPSTONE spine exists.
L10: metadata:
L11: short-description: CAPSTONE pitch — sharpen Clarity through Essence
...
L21:
L22: Canonical method: **CAPSTONE** (Daniel Priestley). Source notes: [references/priestley-capstone.md
Findings
1 Critical3 High3 Medium3 Low
CriticalAi Agent Control Hijackscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/install.js
HighRuntime Package Installscripts/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to pitch-skills@1.4.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing pitch-skills@1.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.