registry / surf-agent-skill / 9.0.0

surf-agent-skill@9.0.0

Autonomous web research for AI coding agents, on Brave Search and nothing else. The CLI runs the whole loop: an LLM (DeepSeek v4 Pro via OpenRouter) plans the queries, up to --sub-agents of them run at once against Brave — paced to your plan's real rate l

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The source confirms automatic global-install setup of first-party agent skills, which warrants a warning under the agent integration policy. The inspected behavior does not establish a concrete attack or justify blocking publication.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package globally with npm.

Impact

The installed skills become available to supported agents; no private prompt or tool-content export or other concrete attack was identified.

Mechanism

The postinstall hook links or copies package-owned skill directories into agent skill locations and initializes a blank Surf key configuration file.

AI rationale

Evidence

package.jsonsrc/install/postinstall.mjssrc/lib/harness-install.mjssrc/lib/project-config.mjsbin/surf-plan-skill.mjs

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs postinstall automatically, while the installer limits system changes to global installs.
Global postinstall links three package-owned skills into supported agent skill directories and creates an empty Surf key configuration file if absent.
The project configuration writer is reached through an explicit CLI command and changes only harness timeout settings.
The plan CLI describes itself as a plan-file and diagnostics helper; no concrete attack behavior was established in the inspected source.

Evidence against

The inspected installer does not configure agent prompt or tool-content export, and the key file is initialized with blank provider sections.
The project configuration changes are explicit-command behavior and concern bash timeouts, not agent control or data export.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

4 flagged

package.jsonView file

Lines 14-54json

14 },

15 "bin": {

16 "surf": "./bin/surf.mjs",

17 "surf-research-skill": "./bin/surf-research-skill.mjs",

18 "surf-search-normal": "./bin/surf-search-normal.mjs",

19 "surf-search-unlimit": "./bin/surf-search-unlimit.mjs",

20 "surf-plan-skill": "./bin/surf-plan-skill.mjs"

21 },

22 "files": [

23 "bin/",

24 "src/",

25 "skills/",

26 "references/",

27 "SKILL.md",

28 "README.md",

29 "CHANGELOG.md",

30 "LICENSE",

31 "logo.png"

32 ],

33 "scripts": {

34 "postinstall": "node ./src/install/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 "preuninstall": "node ./src/install/preuninstall.mjs || true",

36 "build": "npm run test:syntax",

37 "sync:version": "node ./scripts/sync-version.mjs",

38 "version": "node ./scripts/sync-version.mjs && git add SKILL.md skills/surf-plan-agent-skill/SKILL.md skills/surf-search-agent-skill/SKILL.md",

39 "predev": "npm run build",

40 "dev": "node ./bin/surf.mjs",

41 "predev:search": "npm run build",

42 "dev:search": "node ./bin/surf-research-skill.mjs",

43 "predev:plan": "npm run build",

44 "dev:plan": "node ./bin/surf-plan-skill.mjs",

45 "predev:ai": "npm run build",

46 "dev:ai": "node ./bin/surf-search-normal.mjs",

47 "predev:ai-unlimit": "npm run build",

48 "dev:ai-unlimit": "node ./bin/surf-search-unlimit.mjs",

49 "predev:install": "npm run build",

50 "dev:install": "SURF_DEV=1 node ./src/install/postinstall.mjs",

51 "dev:uninstall": "SURF_DEV=1 node ./src/install/preuninstall.mjs",

52 "test": "npm run test:syntax || exit 1; bad=''; for f in ./test/smoke.mjs ./test/brave.mjs; do echo ''; echo \"== $f\"; node \"$f\" || bad=\"$bad $f\"; done; echo ''; npm run --silent test:adversarial || bad=\"$bad test:adversarial\"; if [ -n \"$bad\" ]; then echo \"GATE RED, failed:$bad\"; exit 1; fi; echo 'GATE GREEN'; exit 0",

53 "test:syntax": "for f in bin/*.mjs scripts/*.mjs src/index.mjs src/env.mjs src/install/*.mjs src/lib/*.mjs src/lib/ai/*.mjs src/lib/providers/*.mjs src/lib/api/*.mjs src/plan/*.mjs src/validators/*.mjs; do node --check \"$f\" || exit 1; done && echo syntax-ok",

54 "test:adversarial": "bad=''; n=0; for f in ./test/adversarial/*.mjs; do [ -f \"$f\" ] || continue; n=$((n+1)); echo ''; echo \"== $f\"; node \"$f\" || bad=\"$bad $f\"; done; if [ \"$n\" -eq 0 ]; then echo 'no adversarial suite found under test/adversarial/'; exit 1; fi; if [ -n \"$bad\" ]; then echo \"ADVERSARIAL RED, failed:$bad\"; exit 1; fi; echo \"

src/lib/harness-install.mjsView file

Lines 1-24javascript

1// Cross-OS skill registration helpers used by postinstall / preuninstall.

2//

3// Strategy:

4// - Symlink the package root into each harness's skill dir

5// (~/.claude/skills/<skill-name>, ~/.agents/skills/<skill-name>, etc.)

6// - On Windows: try fs.symlink with type='junction' first (no admin needed

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/lib/harness-install.mjsView on unpkg · L4

7// for directories). If EPERM/ENOSYS, fall back to recursive copy.

bin/surf-plan-skill.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/surf-plan-skill.mjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/install/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/install/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/lib/harness-install.mjsView file

4// - Symlink the package root into each harness's skill dir L5: // (~/.claude/skills/<skill-name>, ~/.agents/skills/<skill-name>, etc.) L6: // - On Windows: try fs.symlink with type='junction' first (no admin needed ... L55: const HARNESS_DIR_SUFFIXES = [ L56: path.join('.agents', 'skills'), // OpenCode + GH Copilot CLI canonical L57: path.join('.claude', 'skills'), // Claude Code L58: path.join('.codex', 'skills'), // OpenAI Codex CLI L59: path.join('.pi', 'agent', 'skills'), // Pi Coding Agent ... L204: // Fallback: recursive copy (Windows without dev mode). L205: await fs.cp(target, link, { recursive: true }); L206: return { action: 'copied' }; ... L251: //

Findings

1 Critical2 High4 Medium5 Low

CriticalAi Agent Control Hijacksrc/lib/harness-install.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedbin/surf-plan-skill.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to surf-agent-skill@9.0.0.

See all versions of surf-agent-skill for other recorded verdicts.

Review the evidence and your use of surf-agent-skill@9.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 03:41:22.440Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code