registry / AI-agent control-surface risk / transcript-summary-skill
transcript-summary-skill
Install the transcript-summary agent skill for Grok, Claude Code, Copilot, Gemini CLI, and Codex.
This report shows the evidence for transcript-summary-skill@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe postinstall hook automatically and destructively installs a skill across multiple unrelated AI-agent directories. This meets the install-control-surface blocking policy despite no observed credential theft.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall
Impact
Adds package-controlled instructions to multiple AI-agent control surfaces and overwrites prior same-named skills.
Mechanism
Recursive replacement and copying into AI-agent skill directories
Policy narrative
Installing the npm package automatically runs cli.js. With no arguments, the code selects six agent platforms, deletes any existing transcript-summary skill folder in each home-directory control surface, and copies the package into those locations. This is unconsented install-time mutation of broad AI-agent control surfaces.
AI rationale
The postinstall hook automatically and destructively installs a skill across multiple unrelated AI-agent directories. This meets the install-control-surface blocking policy despite no observed credential theft.
Evidence
package.jsoncli.js$HOME/.grok/skills/transcript-summary$HOME/.claude/skills/transcript-summary$HOME/.copilot/skills/transcript-summary$HOME/.gemini/skills/transcript-summary$HOME/.codex/skills/transcript-summary$HOME/.agents/skills/transcript-summary
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs cli.js automatically in postinstall.
- The installer defaults to installing into six separate AI-agent skill directories under the user's home directory.
- It recursively removes each existing transcript-summary skill directory before copying its files there.
Evidence against
- The normal packaged path uses the included SKILL.md, so its remote-download fallback is not reached.
- No credential collection or data-exfiltration code was found in the inspected source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgcli.jsView file
22grok: path.join(HOME, ".grok", "skills", NAME),
L23: claude: path.join(HOME, ".claude", "skills", NAME),
L24: copilot: path.join(HOME, ".copilot", "skills", NAME),
L25: gemini: path.join(HOME, ".gemini", "skills", NAME),
L26: openai: path.join(HOME, ".codex", "skills", NAME),
L27: codex: path.join(HOME, ".codex", "skills", NAME),
L28: agents: path.join(HOME, ".agents", "skills", NAME),
L29: };
...
L43: fs.rmSync(dest, { recursive: true, force: true });
L44: fs.mkdirSync(path.dirname(dest), { recursive: true });
L45: fs.cpSync(src, dest, {
L46: recursive: true,
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
cli.jsView on unpkg · L227const path = require("path");
L8: const { spawnSync } = require("child_process");
L9: const { pipeline } = require("stream/promises");
Findings
1 Critical6 High4 Medium3 Low
CriticalAi Agent Control Hijackcli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli.js
HighSame File Env Network Executioncli.js
HighSandbox Evasion Gated Capabilitycli.js
HighKnown Malware Source Similaritycli.js
HighKnown Malware Source Fingerprint Signaturecli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to transcript-summary-skill@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing transcript-summary-skill@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.