Loading npm security reports…

sdd-flow-kit@1.7.36: AI-agent control-surface risk | LPM Firewall

registry / sdd-flow-kit / 1.7.36

sdd-flow-kit@1.7.36

Cross-agent SDD automated development workflow kit with PRD layered architecture, task splitting, context compression, and pending confirmations.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates a consumer project’s AI-agent control surfaces and permission settings. It also deploys a template containing embedded Confluence authentication material.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Enables package-supplied instructions across multiple agent platforms and broadens Claude Code Bash approval permissions in the consuming project.

Mechanism

Unconsented cross-agent skill/rule installation and Claude Code permission allowlist mutation

Policy narrative

On installation, the postinstall hook identifies the consuming project and silently runs setup with confirmation bypassed. Setup writes package-controlled skills and trigger rules across Cursor, Claude Code, Codex, and OpenClaw directories, then merges broad command allow rules into Claude Code’s local settings. It also installs a Confluence document helper containing embedded authentication material. These changes occur before any explicit user setup command and alter foreign AI-agent control surfaces.

Rationale

Direct source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent configuration and permission surfaces. This meets the firewall block boundary regardless of the benign-looking workflow purpose.

Evidence

package.jsondist/postinstall.jsdist/steps/setupProject.jsdist/core/claudeCodePermissions.jssrc/templates/skills/confluence-doc.py.templateconsumer-project/.cursor/skills/sdd-flow-kit/SKILL.md

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/agentRemediateInvoke.jsView file

9exports.agentRemediateHint = agentRemediateHint; L10: const child_process_1 = require("child_process"); L11: const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/core/agentRemediateInvoke.jsView on unpkg · L9

dist/core/prdInventoryGate.jsView file

22*/ L23: const path_1 = __importDefault(require("path")); L24: const apiFieldCoverage_1 = require("./apiFieldCoverage");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/prdInventoryGate.jsView on unpkg · L22

dist/postinstall.jsView file

26Install-time code directly mutates a foreign AI-agent control surface: L66: return "cursor"; L67: if (await exists(".claude")) L68: return "claude-code"; L69: if (await exists(".codex")) L70: return "codex"; Write operation from dist/core/fs.js: L26: await promises_1.default.mkdir(path_1.default.dirname(filePath), { recursive: true }); L27: await promises_1.default.writeFile(filePath, content, "utf8"); L28: } Foreign user/project scope from dist/postinstall.js: L66: return "cursor"; L67: if (await exists(".claude")) L68: return "claude-code"; L69: if (await exists(".codex")) L70: return "codex";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall.jsView on unpkg · L26

dist/core/opsxDelivery.jsView file

187const openspecOk = hasCommand("openspec") || L188: (0, child_process_1.spawnSync)("npx", ["openspec", "--version"], { stdio: "ignore", cwd: root }).status === 0; L189: checks.push({

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/opsxDelivery.jsView on unpkg · L187

scripts/install-git-hooks.shView file

•path = scripts/install-git-hooks.sh kind = build_helper sizeBytes = 790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-git-hooks.shView on unpkg

dist/core/playwrightEnsure.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/playwrightEnsure.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/playwrightEnsure.jsView on unpkg

dist/core/apiLiveProbe.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/apiLiveProbe.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/apiLiveProbe.jsView on unpkg

dist/core/devPort.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/devPort.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/devPort.jsView on unpkg

dist/core/validateReviewSubagent.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = [redacted].js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/validateReviewSubagent.jsView on unpkg

dist/core/acSourceTrace.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/acSourceTrace.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/acSourceTrace.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 7-47json

7 "engines": {

8 "node": ">=14.16.0"

9 },

10 "type": "commonjs",

11 "main": "dist/index.js",

12 "files": [

13 "dist",

14 "src/templates",

15 "src/tests/fixtures",

16 "scripts",

17 "README.md",

18 "docs"

19 ],

20 "bin": {

21 "sdd-flow-kit": "dist/cli.js"

22 },

23 "scripts": {

24 "build": "tsc -p tsconfig.json",

25 "start": "node dist/cli.js",

26 "prepublishOnly": "npm run build",

27 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "npm run build && node dist/tests/acMatrix.test.js && node dist/tests/proposeArtifacts.test.js && node dist/tests/analysisInputScan.test.js && node dist/tests/backendSkillDetector.test.js && node dist/tests/doc03Quality.test.js && node dist/tests/runGuard.test.js && node dist/tests/techDocQuality.test.js && node dist/tests/uiInteractionGate.test.js && node dist/tests/demoProposalConsistency.test.js && node dist/tests/acLayerCoverageGate.test.js && node dist/tests/acSourceTrace.test.js && node dist/tests/acInteractionGapGate.test.js && node dist/tests/prdInventoryGate.test.js && nod ...

29 },

30 "devDependencies": {

31 "@mermaid-js/mermaid-cli": "10.9.1",

32 "@types/node": "^20.14.10",

33 "puppeteer": "19.11.1",

34 "typescript": "^5.6.3"

35 },

36 "pnpm": {

37 "onlyBuiltDependencies": [

38 "sdd-flow-kit"

39 ]

40 },

41 "keywords": [

42 "sdd",

43 "software-design-description",

44 "workflow",

45 "automation",

46 "ai-agent",

47 "cursor",

Long lines were clipped for display.

dist/core/agentRemediateInvoke.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/core/prdInventoryGate.jsView file

Lines 2-42javascript

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

dist/postinstall.jsView file

Lines 6-46javascript

6 desc = { enumerable: true, get: function() { return m[k]; } };

7 }

8 Object.defineProperty(o, k2, desc);

9}) : (function(o, m, k, k2

dist/core/opsxDelivery.jsView file

Lines 167-207javascript

167 repairedScripts,

168 checks,

169 plannedActions,

170 };

171}

172async function collectDeliverySetupChecks(installRoot) {

173 var _a, _b, _c, _d, _e, _f, _g;

174

scripts/install-git-hooks.shView file

•path = scripts/install-git-hooks.sh kind = build_helper sizeBytes = 790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-git-hooks.shView on unpkg

dist/core/playwrightEnsure.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/playwrightEnsure.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/playwrightEnsure.jsView on unpkg

dist/core/apiLiveProbe.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/apiLiveProbe.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/apiLiveProbe.jsView on unpkg

dist/core/devPort.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/devPort.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/devPort.jsView on unpkg

dist/core/validateReviewSubagent.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = [redacted].js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/validateReviewSubagent.jsView on unpkg

dist/core/acSourceTrace.jsView file

•matchType = normalized_sha256 matchedPackage = sdd-flow-kit@1.7.29 matchedPath = dist/core/acSourceTrace.js matchedIdentity = npm:c2RkLWZsb3cta2l0:1.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/acSourceTrace.jsView on unpkg