Loading npm security reports…

silt-design-mode@0.1.15: AI-agent control-surface risk | LPM Firewall

registry / silt-design-mode / 0.1.15

silt-design-mode@0.1.15

Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.

AI Security Review

scanned 29d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's AI-agent instructions. It can create Claude Code skill files based on a machine-wide Claude Code marker, not just a project-local agent configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs postinstall.

Impact

A dependency installation can alter the instructions and tool-routing behavior of coding agents in an unrelated consumer project.

Mechanism

Postinstall writes AGENTS.md and agent skill files into the consumer project.

Policy narrative

The postinstall hook obtains npm's consumer working directory and calls installSkill. That function unconditionally adds a marked block to AGENTS.md in an eligible project. If no project agent directory exists but the user's home directory contains .claude, it selects the Claude Code target and creates project-local skill and command files. The injected instructions route agents toward package-provided Silt MCP capabilities. This is an unconsented install-time mutation of a broad AI-agent control surface.

AI rationale

This is a concrete automatic postinstall modification of consumer AI-agent control files, including AGENTS.md and newly created .claude files. The safeguards against clobbering do not establish consent for this foreign project mutation.

Evidence

package.jsonbin/footprint/postinstall.mjsbin/footprint/agent-files.mjsAGENTS.md.claude/skills/<slug>/SKILL.md.claude/commands/silt-send.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/footprint/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/footprint/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.mjsView file

42Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L42: */ L43: import { execFileSync, spawn } from 'node:child_process'; L44: import { randomUUID } from 'node:crypto'; L45: import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'; L46: import { createServer } from 'node:http'; L47: import { join, resolve } from 'node:path'; ... L64: * that port and fail if it is taken; a stated port is a decision, not a hint. */ L65: const EXPLICIT_PORT = process.env.DM_PORT ?? argOf('--port'); L66: const HOST = '127.0.0.1'; // loopback only — this must never listen on a network interface ... L75: /** L76: * THE ONE-SHOT VERBS, as data: which module holds each, and which function

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.mjsView on unpkg · L42

143*/ L144: const { coverageRows } = await import('./footprint/surfaces.mjs'); L145: console.log('');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L143

bin/footprint/agent-files.mjsView file

76Install-time code directly mutates a foreign AI-agent control surface: L76: * a coin-flip bug. It was the test harness: the same prompt returns empty on ~1 of 3 runs L77: * with the skills split, with the content in CLAUDE.md instead, and with no skill present L78: * at all — so headless `-p` intermittently ends a turn with no text here regardless. The ... L99: * L100: * CLAUDE CODE ONLY, on purpose. `.claude/commands/<name>.md` is a project-scoped slash L101: * command named by its filename. Cursor's and Codex's equivalents differ, and guessing a ... L107: const COMMANDS = [ L108: { file: 'SEND-COMMAND.md', marker: '.claude', at: '.claude/commands/silt-send.md' }, L109: ]; ... L122: * sk[redacted] 53% (the skill was never invoked in 56% of cases), skills plus an L123: * explicit instructi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/footprint/agent-files.mjsView on unpkg · L76

bin/push/push-readiness.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/push/push-readiness.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 2-42json

2 "name": "silt-design-mode",

3 "version": "0.1.15",

4 "description": "Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.",

5 "license": "SEE LICENSE IN LICENSE",

6 "homepage": "https://silt.app",

7 "engines": {

8 "node": "^22.18.0 || >=24.11.0"

9 },

10 "type": "module",

11 "main": "./dist/index.js",

12 "scripts": {

13 "lab": "vite",

14 "check": "tsc --noEmit",

15 "lint": "eslint src bin build lab test",

16 "build:lab": "vite build",

17 "build": "vite build -c vite.lib.config.ts && tsc -p tsconfig.build.json",

18 "test": "npm run build && node --test test/*.test.mjs",

19 "test:e2e": "playwright test",

20 "prepack": "npm run build",

21 "pack:web": "npm pack",

22 "postinstall": "node bin/footprint/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "dependencies": {

25 "@babel/parser": "^8.0.4",

26 "magicast": "^0.5.4"

27 },

28 "devDependencies": {

29 "@hugeicons/core-free-icons": "^1.1.0",

30 "@hugeicons/react": "^1.1.0",

31 "@playwright/test": "^1.62.1",

32 "@types/node": "^22.20.1",

33 "@types/react": "18.3.3",

34 "@types/react-dom": "18.3.0",

35 "@vitejs/plugin-react": "^4.3.4",

36 "dialkit": "^1.4.3",

37 "eslint": "^10.8.0",

38 "react": "18.3.1",

39 "react-dom": "18.3.1",

40 "typescript": "~5.6.3",

41 "typescript-eslint": "^8.66.0",

42 "vite": "^6.3.5"

bin/cli.mjsView file

Lines 22-62javascript

22 * non-interactive mode, because it is what this repo's users already have

23 * authenticated; override with DM_RUNNER (a shell command that receives the

24 * prompt on stdin, with {model} and {file} placeholders) to use anything else.

25 *

26

bin/footprint/agent-files.mjsView file

Lines 56-96javascript

56 * on trigger clarity alone: an agent asked to "set up silt and log in" should not have to

57 * read 6 KB of "make exactly those edits / change nothing / report per annotation" to

58 * reach the four commands it needs.

59 *

bin/push/push-readiness.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/push/push-readiness.mjs#virtual:normalized:round1View on unpkg