registry / swe-workflow-skills / 0.2.0

swe-workflow-skills@0.2.0

A curated library of 44 Claude Code Agent Skills for the software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit install command deploys a first-party Claude Code skill library and optional SessionStart hook. The hook changes local skill activation settings and adds workflow instructions at session boundaries; no exfiltration or remote execution is established.

Static reason

No blocking static signals were detected.

Trigger

User runs `swe-workflow-skills install` and manually registers the printed SessionStart hook snippet.

Impact

Can influence Claude Code workflow behavior and rewrite package-managed `skillOverrides` in the chosen config directory.

Mechanism

First-party Claude skill/config setup with a persistent SessionStart context hook.

Rationale

Source establishes an explicit, first-party agent-extension setup that persists workflow guidance through a manually registered hook. It is not concrete malware, but warrants a warning for AI-agent control-surface impact.

Evidence

package.jsonbin/cli.mjsinstall.mjsscripts/resolve.mjshooks/session-start.mjsuninstall.mjs.claude/skills/*.claude/hooks/resolve.mjs.claude/hooks/session-start.mjs.claude/commands/role.md.claude/settings.local.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`install.mjs` is an explicit CLI installer that copies package skills and a SessionStart hook into a selected Claude config directory.
`install.mjs` writes `.claude/settings.local.json` skillOverrides and installs `.claude/hooks/session-start.mjs`.
`hooks/session-start.mjs` dynamically imports the package-owned resolver and rewrites the local skill baseline on every SessionStart.
Installed hook injects persistent workflow-routing instructions into Claude session context.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook; only `prepublishOnly` runs before publishing.
`bin/cli.mjs` dispatches only explicit `install` or `uninstall` commands using the local Node executable.
No network client, endpoint, credential harvesting, shell execution, eval, or remote payload loader appears in executable source.
The installer explicitly does not edit `.claude/settings.json`; it prints a hook-registration snippet for the user to merge.
`uninstall.mjs` asks for confirmation by default and removes only package-named files plus its skillOverride entries.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 36.1 KB of source

Source & flagged code

2 flagged

hooks/session-start.mjsView file

Lines 57-97javascript

58Skip ONLY for genuinely trivial, conversational, or information-lookup replies,

59or when the user tells you not to use a skill or to "just do X" — the user's

60explicit instructions always take precedence.`;

62// Active role, if one was set (by install --role or the /role command).

63let role = "";

64const activeRoleFile = join(SKILLS_DIR, ".active-role");

65if (existsSync(activeRoleFile)) {

66 try {

67 role = readFileSync(activeRoleFile, "utf-8").replace(/\s+/g, "");

68 } catch {

69 role = "";

70 }

71}

73// Write the name-only baseline (promote pinned ∪ active-role to "on"). Best-effort:

74// if resolve.mjs / roles.json / skills aren't present, skip silently. resolve.mjs

75// is a sibling once installed; fall back to the repo location for in-tree runs.

76async function loadResolve() {

77 for (const p of [join(SCRIPT_DIR, "resolve.mjs"), join(SCRIPT_DIR, "..", "scripts", "resolve.mjs")]) {

78 if (existsSync(p)) return import(pathToFileURL(p).href);

79 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hooks/session-start.mjsView on unpkg · L77

80 return null;

81}

83function isDir(p) {

84 return existsSync(p) && statSync(p).isDirectory();

85}

87try {

88 if (existsSync(ROLES_FILE) && isDir(SKILLS_DIR)) {

89 const resolveMod = await loadResolve();

90 if (resolveMod) {

91 const data = resolveMod.loadRoles(ROLES_FILE);

92 // A stale/removed role in .active-role must NOT abort the hook: applyBaseline

93 // calls process.exit on an unknown role (uncatchable), which would suppress the

94 // nudge below. Fall back to the baseline if the marker no longer names a role.

95 if (role && !(data.roles && role in data.roles)) role = "";

96 resolveMod.applyBaseline(data, SETTINGS, SKILLS_DIR, role || null);

97 }

skills/infrastructure-as-code/references/iac-patterns.mdView file

Lines 126-166markdown

126```hcl

127resource "aws_db_instance" "main" {

128 storage_encrypted = true # Always

129 # ...

130}

131

132resource "aws_s3_bucket_server_side_encryption_configuration" "main" {

133 bucket = aws_s3_bucket.main.id

134 rule {

135 apply_server_side_encryption_by_default {

136 sse_algorithm = "aws:kms"

137 }

Source & flagged code

2 flagged · loading source

hooks/session-start.mjsView file

77for (const p of [join(SCRIPT_DIR, "resolve.mjs"), join(SCRIPT_DIR, "..", "scripts", "resolve.mjs")]) { L78: if (existsSync(p)) return import(pathToFileURL(p).href); L79: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hooks/session-start.mjsView on unpkg · L77

skills/infrastructure-as-code/references/iac-patterns.mdView file

146patternName = generic_password severity = medium line = 146 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in skills/infrastructure-as-code/references/iac-patterns.md

skills/infrastructure-as-code/references/iac-patterns.mdView on unpkg · L146

Findings

3 Medium3 Low

MediumDynamic Requirehooks/session-start.mjs

MediumEnvironment Vars

MediumSecret Patternskills/infrastructure-as-code/references/iac-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

hooks/session-start.mjsView file

Lines 57-97javascript

58Skip ONLY for genuinely trivial, conversational, or information-lookup replies,

59or when the user tells you not to use a skill or to "just do X" — the user's

60explicit instructions always take precedence.`;

62// Active role, if one was set (by install --role or the /role command).

63let role = "";

64const activeRoleFile = join(SKILLS_DIR, ".active-role");

65if (existsSync(activeRoleFile)) {

66 try {

67 role = readFileSync(activeRoleFile, "utf-8").replace(/\s+/g, "");

68 } catch {

69 role = "";

70 }

71}

73// Write the name-only baseline (promote pinned ∪ active-role to "on"). Best-effort:

74// if resolve.mjs / roles.json / skills aren't present, skip silently. resolve.mjs

75// is a sibling once installed; fall back to the repo location for in-tree runs.

76async function loadResolve() {

77 for (const p of [join(SCRIPT_DIR, "resolve.mjs"), join(SCRIPT_DIR, "..", "scripts", "resolve.mjs")]) {

78 if (existsSync(p)) return import(pathToFileURL(p).href);

79 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hooks/session-start.mjsView on unpkg · L77

80 return null;

81}

83function isDir(p) {

84 return existsSync(p) && statSync(p).isDirectory();

85}

87try {

88 if (existsSync(ROLES_FILE) && isDir(SKILLS_DIR)) {

89 const resolveMod = await loadResolve();

90 if (resolveMod) {

91 const data = resolveMod.loadRoles(ROLES_FILE);

92 // A stale/removed role in .active-role must NOT abort the hook: applyBaseline

93 // calls process.exit on an unknown role (uncatchable), which would suppress the

94 // nudge below. Fall back to the baseline if the marker no longer names a role.

95 if (role && !(data.roles && role in data.roles)) role = "";

96 resolveMod.applyBaseline(data, SETTINGS, SKILLS_DIR, role || null);

97 }

skills/infrastructure-as-code/references/iac-patterns.mdView file

Lines 126-166markdown

126```hcl

127resource "aws_db_instance" "main" {

128 storage_encrypted = true # Always

129 # ...

130}

131

132resource "aws_s3_bucket_server_side_encryption_configuration" "main" {

133 bucket = aws_s3_bucket.main.id

134 rule {

135 apply_server_side_encryption_by_default {

136 sse_algorithm = "aws:kms"

137 }