Loading npm security reports…

silt-design-mode@0.1.6: AI-agent control-surface risk | LPM Firewall

registry / silt-design-mode / 0.1.6

silt-design-mode@0.1.6

Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently mutates the consuming repository's AI-agent instruction surface. It adds an AGENTS.md block and may create Claude/Cursor/Codex agent skill files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install executes the postinstall hook.

Impact

A dependency changes instructions loaded by coding agents in the consumer project without an explicit user command.

Mechanism

postinstall-driven AI-agent configuration injection

Policy narrative

On npm installation, the package uses INIT_CWD to target the consumer project and calls installSkill. That function always splices or creates AGENTS.md, then writes agent-specific skill files for detected agent directories. If none are detected but ~/.claude exists, it creates Claude project skills anyway. These files are loaded as coding-agent instructions and are introduced without an explicit setup command.

Rationale

The package performs unconsented postinstall mutation of a consumer repository's broad AI-agent control surface. Project and home-directory guards reduce scope but do not make this install-time behavior consensual.

Evidence

package.jsonbin/postinstall.mjsbin/skill-install.mjsskill/AGENTS-BLOCK.mdAGENTS.md.claude/skills/silt-design-mode/SKILL.md.claude/skills/silt-setup/SKILL.md.claude/skills/silt/SKILL.md.claude/commands/silt-send.md.cursor/rules/silt-design-mode.mdc

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.mjsView file

42Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L42: */ L43: import { execFileSync, spawn } from 'node:child_process'; L44: import { randomUUID } from 'node:crypto'; L45: import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'; L46: import { createServer } from 'node:http'; L47: import { join, resolve } from 'node:path'; ... L64: * that port and fail if it is taken; a stated port is a decision, not a hint. */ L65: const EXPLICIT_PORT = process.env.DM_PORT ?? argOf('--port'); L66: const HOST = '127.0.0.1'; // loopback only — this must never listen on a network interface ... L75: /** L76: * THE ONE-SHOT VERBS, as data: which module holds each, and which function

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.mjsView on unpkg · L42

129const { from, call } = VERBS[cmd]; L130: const mod = await import(from); L131: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L129

bin/skill-install.mjsView file

74Install-time code directly mutates a foreign AI-agent control surface: L74: * a coin-flip bug. It was the test harness: the same prompt returns empty on ~1 of 3 runs L75: * with the skills split, with the content in CLAUDE.md instead, and with no skill present L76: * at all — so headless `-p` intermittently ends a turn with no text here regardless. The ... L97: * L98: * CLAUDE CODE ONLY, on purpose. `.claude/commands/<name>.md` is a project-scoped slash L99: * command named by its filename. Cursor's and Codex's equivalents differ, and guessing a ... L105: const COMMANDS = [ L106: { file: 'SEND-COMMAND.md', marker: '.claude', at: '.claude/commands/silt-send.md' }, L107: ]; ... L120: * sk[redacted] 53% (the skill was never invoked in 56% of cases), skills plus an L121: * explicit instruction

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/skill-install.mjsView on unpkg · L74

Source & flagged code

5 flagged

package.jsonView file

Lines 2-42json

2 "name": "silt-design-mode",

3 "version": "0.1.6",

4 "description": "Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.",

5 "license": "SEE LICENSE IN LICENSE",

6 "homepage": "https://silt.app",

7 "engines": {

8 "node": "^22.18.0 || >=24.11.0"

9 },

10 "type": "module",

11 "main": "./dist/index.js",

12 "scripts": {

13 "lab": "vite",

14 "check": "tsc --noEmit",

15 "lint": "eslint src bin build lab test",

16 "build:lab": "vite build",

17 "build": "vite build -c vite.lib.config.ts && tsc -p tsconfig.build.json",

18 "test": "npm run build && node --test test/*.test.mjs",

19 "test:e2e": "playwright test",

20 "prepack": "npm run build",

21 "pack:web": "npm pack",

22 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "dependencies": {

25 "@babel/parser": "^8.0.4",

26 "magicast": "^0.5.4"

27 },

28 "devDependencies": {

29 "@hugeicons/core-free-icons": "^1.1.0",

30 "@hugeicons/react": "^1.1.0",

31 "@playwright/test": "^1.62.1",

32 "@types/node": "^22.20.1",

33 "@types/react": "18.3.3",

34 "@types/react-dom": "18.3.0",

35 "@vitejs/plugin-react": "^4.3.4",

36 "dialkit": "^1.4.3",

37 "eslint": "^10.8.0",

38 "react": "18.3.1",

39 "react-dom": "18.3.1",

40 "typescript": "~5.6.3",

41 "typescript-eslint": "^8.66.0",

42 "vite": "^6.3.5"

bin/cli.mjsView file

Lines 22-62javascript

22 * non-interactive mode, because it is what this repo's users already have

23 * authenticated; override with DM_RUNNER (a shell command that receives the

24 * prompt on stdin, with {model} and {file} placeholders) to use anything else.

25 *

26

bin/skill-install.mjsView file

Lines 54-94javascript

54 * on trigger clarity alone: an agent asked to "set up silt and log in" should not have to

55 * read 6 KB of "make exactly those edits / change nothing / report per annotation" to

56 * reach the four commands it needs.

57 *