Loading npm security reports…

rplay-cli@2.0.1: AI-agent control-surface risk | LPM Firewall

registry / rplay-cli / 2.0.1

rplay-cli@2.0.1

Rplay from the terminal: everything the dashboard shows and does, as JSON — session replay analytics, checkout funnels, attribution, ad spend, alerts, postbacks. Built for scripts and AI agents; installs its own agent skill.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall writes package-controlled skill files into three AI-agent control surfaces. CLI startup also restores or updates those files automatically.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global package installation or any invocation of the rplay CLI.

Impact

Package-authored instructions become available to Claude, Codex, and shared agent runtimes without an explicit setup command.

Mechanism

Automatic cross-agent skill installation and refresh.

Policy narrative

Installing this package globally runs its postinstall hook, which creates and writes skill files under the user’s Claude, Codex, and shared agent directories. Separately, every CLI run checks whether those skills are current and reinstalls them when needed. This is an unconsented lifecycle mutation of broad AI-agent control surfaces.

AI rationale

The package automatically persists package-controlled instructions into multiple unrelated AI-agent skill directories during installation and runtime. The opt-out does not make this an explicit user-command setup.

Evidence

package.jsonscripts/postinstall.jssrc/skill.jssrc/cli.js~/.claude/skills/rplay/SKILL.md~/.claude/skills/rplay/AI.md~/.codex/skills/rplay/SKILL.md~/.codex/skills/rplay/AI.md~/.agents/skills/rplay/SKILL.md~/.agents/skills/rplay/AI.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/commands/index.jsView file

5const path = require('path'); L6: const { execSync } = require('child_process'); L7: const { CliError, readConfig, writeConfig, baseUrl, token, CONFIG_FILE, defaultUrl } = require('../config');

High

Child Process

Package source references child process execution.

src/commands/index.jsView on unpkg · L5

5const path = require('path'); L6: const { execSync } = require('child_process'); L7: const { CliError, readConfig, writeConfig, baseUrl, token, CONFIG_FILE, defaultUrl } = require('../config'); ... L17: const cfg = readConfig(); L18: const url = String(flags.url || cfg.url || defaultUrl() || await ask('Rplay URL (e.g. https://app.rplay.dev): ')).replace(/\/+$/, ''); L19: if (!url) throw new CliError('an Rplay URL is required'); L20: let tok = flags.token || process.env.RPLAY_TOKEN; L21: if (!tok) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/commands/index.jsView on unpkg · L5

360if (installedViaNpm()) { L361: execSync('npm install -g rplay-cli@latest', { stdio: 'inherit' }); L362: return { ok: true, method: 'npm', note: 'skill refreshed by postinstall' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/index.jsView on unpkg · L360

bin/rplay.jsView file

2'use strict'; L3: require('../src/cli.js').main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rplay.jsView on unpkg · L2

src/skill.jsView file

1// Installs the agent skill next to the CLI: Claude Code, Codex and the L2: // shared ~/.agents directory read SKILL.md; AI.md sits beside it as the full L3: // manual the skill links to. Idempotent, version-stamped, never fatal. ... L14: return { L15: claude: path.join(root, '.claude', 'skills', 'rplay'), L16: codex: path.join(root, '.codex', 'skills', 'rplay'), L17: agents: path.join(root, '.agents', 'skills', 'rplay') L18: }; ... L47: if (!dir) continue; L48: fs.mkdirSync(dir, { recursive: true }); L49: fs.writeFileSync(path.join(dir, 'SKILL.md'), skill); L50: if (ai) fs.writeFileSync(path.join(dir, 'AI.md'), ai);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/skill.jsView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "rplay-cli",

3 "version": "2.0.1",

4 "description": "Rplay from the terminal: everything the dashboard shows and does, as JSON — session replay analytics, checkout funnels, attribution, ad spend, alerts, postbacks. Built for scripts and AI agents; installs its own agent skill.",

5 "license": "MIT",

6 "bin": { "rplay": "bin/rplay.js" },

7 "main": "src/cli.js",

8 "engines": { "node": ">=18" },

9 "files": [

10 "bin",

11 "src",

12 "docs",

13 "scripts",

14 "AI.md",

15 "SKILL.md",

16 "README.md"

17 ],

18 "scripts": {

19 "build": "node scripts/build.js",

20 "prepack": "node scripts/build.js",

21 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "node test/run.js"

23 },

24 "keywords": ["rplay", "session-replay", "analytics", "attribution", "cli", "ai-agent", "claude-code", "codex"],

25 "repository": { "type": "git", "url": "git+https://github.com/licodingdevai/web-tracking.git", "directory": "packages/cli" }

26}

27

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/commands/index.jsView file

Lines 1-25javascript

1// Commands that need more than "flags → one HTTP call": setup, composites,

2// imports, the skill, self-update. Everything else is data in registry.js.

3'use strict';

4const fs = require('fs');

5const path = require(

bin/rplay.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2'use strict';

3require('../src/cli.js').main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rplay.jsView on unpkg · L2

4

src/skill.jsView file

Lines 1-21javascript

1// Installs the agent skill next to the CLI: Claude Code, Codex and the

2// shared ~/.agents directory read SKILL.md; AI.md sits beside it as the full

3// manual the skill links to. Idempotent, version-stamped, never fatal.

4'use strict';

5const fs = require('fs');

6const os =

Lines 340-380javascript

340 const [method, p] = args[0] && args[0].startsWith('/') ? ['GET', args[0]] : [String(args[0] || 'GET').toUpperCase(), args[1]];

341 if (!p || !p.startsWith('/api/')) throw new CliError('usage: rplay api [GET|POST|PUT|DELETE] /api/... [--data \'{"json":true}\'] [--text]');

342 const body = flags.data ? JSON.parse(flags.data) : (method === 'GET' ? undefined : {});

343 return call(method, p, flags, body, { text: !!flags.text });

344}

345

346// ---- skill & self-maintenance ----------------------------------------------------------

347async function skillInstall({ flags }) {

348 const which = ['claude', 'codex', 'agents'].filter((k) => flags[k]);

349 const installed = skill.install({ which: which.length ? which : undefined, projectRoot: flags.project ? process.cwd() : null });

350 return { ok: true, version, installed };

351}

352async function skillStatus({ flags }) { return { version, targets: skill.status({ projectRoot: flags.project ? process.cwd() : null }) }; }

353async function skillShow({ flags }) { const f = skill.readSkillFiles(); return flags.ai && f.ai ? f.ai : f.skill; }

354

355function installedViaNpm() {

356 const bin = process.argv[1] || '';

357 return /node_modules[\\/]rplay-cli[\\/]/.test(fs.realpathSync(bin).replace(/\\/g, '/')) || /node_modules/.test(bin);

358}

359async function update({ flags }) {

360 if (installedViaNpm()) {

361 execSync('npm install -g rplay-cli@latest', { stdio: 'inherit' });

362 return { ok: true, method: 'npm', note: 'skill refreshed by postinstall' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/index.jsView on unpkg · L360

363 }

364 const src = await (await fetch(baseUrl(flags) + '/cli/rplay.js')).text();

365 if (!src.startsWith('#!/usr/bin/env node')) throw new CliError('download failed');

366 const target = fs.realpathSync(process.argv[1]);

367 fs.writeFileSync(target, src, { mode: 0o755 });

368 let installed = [];

369 try { installed = skill.install(); } catch { /* single-file build may lack SKILL.md until next run */ }

370 return { ok: true, method: 'download', path: target, skillInstalled: installed };

371}

372

373function completion({ args }) {

374 const shell = args[0] || 'zsh';

375 const { commands } = require('../registry');

376 const words = [...new Set(commands.flatMap((c) => [c.name, ...(c.aliases || [])]).map((n) => n.split(' ')[0]))].sort();

377 const subs = {};

378 for (const c of commands) for (const n of [c.name, ...(c.aliases || [])]) { const [a, b] = n.split(' '); if (b) (subs[a]

379 if (shell === 'bash') {

380 return `_rplay() { local cur=\${COMP_WORDS[COMP_CWORD]}; local prev=\${COMP_WORDS[COMP_CWORD-1]}; case "$prev" in\n` +