registry / AI-agent control-surface risk / sav-agent-skills
sav-agent-skills
赛唯数字能源全套 Agent 技能与 i18n 自动化工具集
This report shows the evidence for sav-agent-skills@1.0.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource confirms a postinstall hook that defaults to injecting package-provided agent instructions into three foreign control surfaces. This meets the install-time AI-agent control-hijack block boundary.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
Host project AI-agent behavior is modified on installation.
Mechanism
unconsented cross-agent skill injection
Policy narrative
Installing the package runs postinstall against the host project. Unless the host preconfigures a package-specific whitelist, it copies all bundled SKILL.md files into Claude, Agents, and Cursor control directories. This is an unconsented mutation of broad foreign AI-agent control surfaces; one injected workflow also instructs later agents to force-delete cache/report files.
AI rationale
Source confirms a postinstall hook that defaults to injecting package-provided agent instructions into three foreign control surfaces. This meets the install-time AI-agent control-hijack block boundary.
Evidence
package.jsonscripts/postinstall.jsskills/i18n-workflow/SKILL.md.claude/skills/<skill>/SKILL.md.agents/skills/<skill>/SKILL.md.cursor/skills/<skill>/SKILL.mdnode_modules/.cache/sav-agent-skills/*.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- Install lifecycle invokes scripts/postinstall.js.
- Postinstall targets the installing project via INIT_CWD.
- Without a whitelist it distributes every bundled skill.
- It writes SKILL.md into .claude, .agents, and .cursor control paths.
- Injected workflow instructs an agent to run forced cache deletion.
Evidence against
- The behavior is documented and supports an optional package whitelist.
- Postinstall itself has no network or shell execution.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
47L48: // 4. 复制并注入选中的 SKILL.md 到目标项目的 .claude/skills 和 .agents/skills 目录
L49: targetSkillFolders.forEach(skillName => {
...
L53:
L54: const claudeSkillDir = path.join(targetProjectDir, '.claude', 'skills', skillName);
L55: const agentsSkillDir = path.join(targetProjectDir, '.agents', 'skills', skillName);
L56: const cursorSkillDir = path.join(targetProjectDir, '.cursor', 'skills', skillName);
...
L58: [claudeSkillDir, agentsSkillDir, cursorSkillDir].forEach(dir => {
L59: fs.mkdirSync(dir, { recursive: true });
L60: fs.writeFileSync(path.join(dir, 'SKILL.md'), skillContent, 'utf-8');
L61: });
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L47dist/index.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
}] ${item.desc}`);
});
console.log(` [${platform_enums.length + 1}] 手动输入其他自定义 platform 名称`);
rl.question(`\n👉 请输入序号 (默认 1 [emp]): `, (answer) => {
rl.close();
const trimmed = answer.trim();
if (!trimmed) {
resolve('emp');
return;
}
const num = parseint(trimmed, 10);
if (!isnan(num) && num >= 1 && num <= platform_enums.length) {
resolve(platform_enums[num - 1].code);
}
else if (num === platform_enums.length + 1) {
const rl2 = readline.createinterface({
input: process.stdin,
outpu
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/index.jsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
input: process.stdin,
output: process.stdout
});
rl2.question('👉 请输入 json 文件相对或绝对路径: ', (custompath) => {
rl2.close();
resolve(custompath.trim() || candidates[0]);
});
}
else {
console.log(`⚠️ 输入无效，自动选择默认选项: ${candidates[0]}`);
resolve(candidates[0]);
}
});
});
}
async function promptselectplatform() {
const rl = readline.createinterface({
input: process.stdin,
output: process.stdout
});
return new promise((resolve) => {
console.log('\n🏷️ 请选择要同步的目标 platform
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/index.jsView on unpkgFindings
1 Critical3 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighExternal Ai Agent Control Surface Mutationdist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to sav-agent-skills@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing sav-agent-skills@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.