Loading npm security reports…

skillenforce: AI-agent control-surface risk | LPM Firewall

registry / skillenforce / 0.2.2

skillenforce@0.2.2

Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall runs the installer with --yes and mutates the user's OpenCode config: plugin, agent, commands, skills, and optional opencode.jsonc. It also globally installs OpenCode, MCP servers, and third-party OpenCode plugins.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or npm install -g skillenforce, which runs the postinstall script

Impact

OpenCode can load this package's plugin and skills plus extra MCP servers and third-party plugins without a separate setup command

Mechanism

unconsented install-time write into OpenCode's global agent config

Policy narrative

Installing the package runs postinstall with --yes, so the installer never asks for confirmation. It globally installs OpenCode if missing, then copies this package's plugin, agent, commands, and skills into the user's OpenCode config directory. It also globally installs third-party MCP servers and OpenCode plugins, including an unpinned @latest plugin, and may create opencode.jsonc that enables remote MCP endpoints. That takes over a foreign AI-agent control surface as soon as the package is installed.

AI rationale

postinstall runs install/install.mjs --yes and writes OpenCode plugins, agents, skills, and config, plus global npm installs, without a user setup command. That is unconsented mutation of a foreign AI-agent control surface.

Evidence

package.jsoninstall/install.mjsadapters/opencode/skillenforce.tsadapters/opencode/agent/skillenforce-agent.md~/.config/opencode/plugins/skillenforce.ts~/.config/opencode/agent/skillenforce-agent.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install/install.mjs --yes

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/install.mjs --yes

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/skillenforce.mjsView file

6const cli = join(here, "..", "src", "cli.ts"); L7: await import(pathToFileURL(cli).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/skillenforce.mjsView on unpkg · L6

install/install.mjsView file

1import { cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs"; L2: import { homedir } from "node:os"; ... L71: const home = sk[redacted](flags); L72: const configDir = flags.scope === "project" ? resolve(".opencode") : opencodeConfigDir(); L73: const skillsDir = join(configDir, "skills"); ... L138: note(`Copie du core vers ${home}`); L139: if (!dryRun) mkdirSync(home, { recursive: true }); L140: for (const item of CORE_ITEMS) { ... L163: if (existsSync(skillsSource)) { L164: const externalRoots = [join(homedir(), ".agents", "skills")]; L165: const alreadyInstalled = skillNamesIn(externalRoots); ... L256: const backup = `${configPath}.sk[redacted]`;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install/install.mjsView on unpkg · L1

3import { join, resolve } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { ... L33: "docs", L34: "package.json", L35: "tsconfig.json", ... L75: L76: const note = (message) => process.stdout.write(`${dryRun ? "[dry-run] " : ""}${message}\n`); L77: ... L163: if (existsSync(skillsSource)) { L164: const externalRoots = [join(homedir(), ".agents", "skills")]; L165: const alreadyInstalled = skillNamesIn(externalRoots);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install/install.mjsView on unpkg · L3

bundled-skills/impeccable/scripts/bin/windows-x64/impeccable.exeView file

•path = bundled-[redacted]-x64/impeccable.exe kind = native_binary sizeBytes = 14720392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundled-skills/impeccable/scripts/bin/windows-x64/impeccable.exeView on unpkg

install/install.shView file

•path = install/install.sh kind = build_helper sizeBytes = 124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/install.shView on unpkg

bundled-skills/impeccable/scripts/modern-screenshot.umd.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundled-skills/impeccable/scripts/modern-screenshot.umd.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 31-71json

31 "skillenforce-bootstrap": "./install/bootstrap.mjs",

32 "skillenforce-install": "./install/install.mjs",

33 "skillenforce-uninstall": "./install/uninstall.mjs",

34 "skillenforce-mcp": "./mcp/skillenforce-tools/index.mjs"

35 },

36 "engines": {

37 "node": ">=22.18.0"

38 },

39 "scripts": {

40 "check": "node src/cli.ts check",

41 "sync": "node src/cli.ts sync",

42 "classify": "node src/cli.ts classify",

43 "catalog": "node src/cli.ts catalog",

44 "report": "node src/cli.ts report",

45 "setup": "node install/install.mjs",

46 "setup:dry": "node install/install.mjs --dry-run",

47 "bootstrap": "node install/bootstrap.mjs",

48 "bootstrap:dry": "node install/bootstrap.mjs --dry-run",

49 "test": "node --test",

50 "typecheck": "tsc --noEmit",

51 "postinstall": "node install/install.mjs --yes"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 },

53 "files": [

54 "src",

55 "catalog",

56 "adapters",

57 "bin",

58 "install",

59 "mcp",

60 "skills",

61 "bundled-skills",

62 "docs",

63 "README.md",

64 "NOTICE.md",

65 "skillenforce.config.example.json",

66 "tsconfig.json",

67 "LICENSE"

68 ],

69 "devDependencies": {

70 "@opencode-ai/plugin": "1.18.30",

71 "@types/node": "24.13.4",

bin/skillenforce.mjsView file

Lines 1-8javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path";

3import { fileURLToPath, pathToFileURL } from "node:url";

4

5const here = dirname(fileURLToPath(

install/install.mjsView file

Lines 1-23javascript

1import { cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs";

2import { homedir } from "node:os";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install/install.mjsView on unpkg · L1

3import { join, resolve } from "node:path";

bundled-skills/impeccable/scripts/bin/windows-x64/impeccable.exeView file

•path = bundled-[redacted]-x64/impeccable.exe kind = native_binary sizeBytes = 14720392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundled-skills/impeccable/scripts/bin/windows-x64/impeccable.exeView on unpkg

install/install.shView file

•path = install/install.sh kind = build_helper sizeBytes = 124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/install.shView on unpkg

bundled-skills/impeccable/scripts/modern-screenshot.umd.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundled-skills/impeccable/scripts/modern-screenshot.umd.js#virtual:normalized:round1View on unpkg