Loading npm security reports…

surf-agent-skill@7.0.0: AI-agent control-surface risk | LPM Firewall

registry / surf-agent-skill / 7.0.0

surf-agent-skill@7.0.0

Autonomous web research for AI coding agents. surf-ai runs the entire loop inside the CLI — an LLM (DeepSeek v4 Pro via OpenRouter) plans the queries, they all run concurrently across Tavily + Parallel + Brave with automatic key rotation and provider fall

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically registers this package as a skill in four third-party AI-agent control surfaces. This changes which instructions those agents can discover without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global installation, which invokes postinstall.

Impact

A package install can alter Claude, Codex, Copilot/OpenCode, and Pi agent behavior through automatic skill registration.

Mechanism

Postinstall symlinks or copies package skills into agent skill directories and creates Surf configuration state.

Policy narrative

Installing the package globally invokes its postinstall hook. The hook treats global installation as authorization to create agent skill directories and register package-controlled skills in four separate AI-agent systems. Those agents may then load the package's instructions during later sessions, although the user did not run an explicit registration command. The hook also creates persistent configuration state. This is an unconsented, broad AI-agent control-surface mutation performed by npm lifecycle execution.

Rationale

The package's global postinstall mutates several foreign AI-agent skill directories automatically. That concrete lifecycle behavior meets the firewall block boundary even though its search networking appears feature-related.

Evidence

package.jsonsrc/install/postinstall.mjssrc/lib/harness-install.mjs~/.agents/skills~/.claude/skills~/.codex/skills~/.pi/agent/skills~/.config/surf/keys.json

Source & flagged code

4 flagged

package.jsonView file

Lines 14-54json

14 "bin": {

15 "surf": "./bin/surf.mjs",

16 "surf-research-skill": "./bin/surf-research-skill.mjs",

17 "surf-search-normal": "./bin/surf-search-normal.mjs",

18 "surf-search-unlimit": "./bin/surf-search-unlimit.mjs",

19 "surf-plan-skill": "./bin/surf-plan-skill.mjs",

20 "surf-free-skill": "./bin/surf-free-skill.mjs"

21 },

22 "files": [

23 "bin/",

24 "src/",

25 "skills/",

26 "references/",

27 "SKILL.md",

28 "README.md",

29 "CHANGELOG.md",

30 "LICENSE",

31 "logo.png"

32 ],

33 "scripts": {

34 "postinstall": "node ./src/install/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 "preuninstall": "node ./src/install/preuninstall.mjs || true",

36 "build": "npm run test:syntax",

37 "predev": "npm run build",

38 "dev": "node ./bin/surf.mjs",

39 "predev:search": "npm run build",

40 "dev:search": "node ./bin/surf-research-skill.mjs",

41 "predev:plan": "npm run build",

42 "dev:plan": "node ./bin/surf-plan-skill.mjs",

43 "predev:free": "npm run build",

44 "dev:free": "node ./bin/surf-free-skill.mjs",

45 "predev:ai": "npm run build",

46 "dev:ai": "node ./bin/surf-search-normal.mjs",

47 "predev:ai-unlimit": "npm run build",

48 "dev:ai-unlimit": "node ./bin/surf-search-unlimit.mjs",

49 "predev:install": "npm run build",

50 "dev:install": "SURF_DEV=1 node ./src/install/postinstall.mjs",

51 "dev:uninstall": "SURF_DEV=1 node ./src/install/preuninstall.mjs",

52 "test": "npm run test:syntax && node ./test/smoke.mjs",

53 "test:syntax": "for f in bin/*.mjs src/index.mjs src/env.mjs src/install/*.mjs src/lib/*.mjs src/lib/ai/*.mjs src/lib/providers/*.mjs src/lib/api/*.mjs src/plan/*.mjs src/validators/*.mjs; do node --check \"$f\" || exit 1; done && echo syntax-ok"

54 },

src/lib/harness-install.mjsView file

Lines 1-24javascript

1// Cross-OS skill registration helpers used by postinstall / preuninstall.

2//

3// Strategy:

4// - Symlink the package root into each harness's skill dir

5// (~/.claude/skills/<skill-name>, ~/.agents/skills/<skill-name>, etc.)

6// - On Windows: try fs.symlink with type='junction' first (no admin needed

7// for directories). If EPERM/ENOSYS, fall back to recursive copy.

8// - Idempotent: re-running fixes stale symlinks, leaves user copies alone.

9

10import { existsSync, promises

bin/surf-plan-skill.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/surf-plan-skill.mjsView on unpkg