registry / AI-agent control-surface risk / surf-agent-skill
surf-agent-skill
Autonomous web research for AI coding agents. surf-ai runs the entire loop inside the CLI — an LLM (DeepSeek v4 Pro via OpenRouter) plans the queries, they all run concurrently across Tavily + Parallel + Brave with automatic key rotation and provider fall
This report shows the evidence for surf-agent-skill@7.0.0. 1 of 4 known versions is blocked or flagged. The newest version, 9.0.0, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package's global postinstall mutates several foreign AI-agent skill directories automatically. That concrete lifecycle behavior meets the firewall block boundary even though its search networking appears feature-related.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm global installation, which invokes postinstall.
Impact
A package install can alter Claude, Codex, Copilot/OpenCode, and Pi agent behavior through automatic skill registration.
Mechanism
Postinstall symlinks or copies package skills into agent skill directories and creates Surf configuration state.
Policy narrative
Installing the package globally invokes its postinstall hook. The hook treats global installation as authorization to create agent skill directories and register package-controlled skills in four separate AI-agent systems. Those agents may then load the package's instructions during later sessions, although the user did not run an explicit registration command. The hook also creates persistent configuration state. This is an unconsented, broad AI-agent control-surface mutation performed by npm lifecycle execution.
AI rationale
The package's global postinstall mutates several foreign AI-agent skill directories automatically. That concrete lifecycle behavior meets the firewall block boundary even though its search networking appears feature-related.
Evidence
package.jsonsrc/install/postinstall.mjssrc/lib/harness-install.mjs~/.agents/skills~/.claude/skills~/.codex/skills~/.pi/agent/skills~/.config/surf/keys.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs a postinstall script automatically.
- On global installation, the script registers skills across four unrelated AI-agent directories.
- Registration creates package symlinks or copies under Claude, Codex, Copilot/OpenCode, and Pi skill paths.
- The lifecycle also creates a persistent Surf configuration file in the user home directory.
Evidence against
- The postinstall exits without changes for ordinary local installs.
- Network requests are implemented for the advertised search providers and are not used by the lifecycle installer.
- The installer preserves existing non-symlink user copies.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./src/install/postinstall.mjs || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./src/install/postinstall.mjs || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/lib/harness-install.mjsView file
4// - Symlink the package root into each harness's skill dir
L5: // (~/.claude/skills/<skill-name>, ~/.agents/skills/<skill-name>, etc.)
L6: // - On Windows: try fs.symlink with type='junction' first (no admin needed
...
L19: export const HARNESS_DIRS = [
L20: path.join(home, '.agents', 'skills'), // OpenCode + GH Copilot CLI canonical
L21: path.join(home, '.claude', 'skills'), // Claude Code
L22: path.join(home, '.codex', 'skills'), // OpenAI Codex CLI
L23: path.join(home, '.pi', 'agent', 'skills'), // Pi Coding Agent
...
L69: // Fallback: recursive copy (Windows without dev mode).
L70: await fs.cp(target, link, { recursive: true });
L71: return { action: 'copied' };
...
L101: //
Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijacksrc/lib/harness-install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/surf-plan-skill.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to surf-agent-skill@7.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing surf-agent-skill@7.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.