registry / AI-agent control-surface risk / ttj-skills-browser
ttj-skills-browser
Renamed to 'ttj-skills-playwright'. Please install: npm i -g ttj-skills-playwright
ttj-skills-browser - Dedicated CDP browser with one-shot commands (eval/goto/screenshot) and page reference visualization
This report shows the evidence for ttj-skills-browser@1.2.18. 5 of 11 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms an automatic postinstall write to both `~/.claude/skills` and `~/.agents/skills`, which is a foreign/broad AI-agent control surface. The unattended global update path compounds the persistence and supply-chain risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
`npm install` activates `postinstall`; invoking the CLI activates the update check.
Impact
Package-controlled agent instructions persist in foreign global control surfaces and can change through later npm releases.
Mechanism
Postinstall AI-agent skill injection and unattended global self-update.
Policy narrative
On npm installation, the postinstall script copies package-supplied instructions into the user's global Claude Code and Codex skill directories without an explicit setup command. Those instructions direct AI-driven browser automation. Separately, each CLI launch checks npm once daily and, if newer, executes a global npm upgrade, allowing future package releases to replace the installed skill and executable automatically. This is unconsented install-time mutation of broad external AI-agent control surfaces.
AI rationale
Source inspection confirms an automatic postinstall write to both `~/.claude/skills` and `~/.agents/skills`, which is a foreign/broad AI-agent control surface. The unattended global update path compounds the persistence and supply-chain risk.
Evidence
package.jsonscripts/install-skill.jsdist/cli.jsdist/browser.jsdist/utils.js.claude/skills/ttj-skills-browser/SKILL.md~/.claude/skills/ttj-skills-browser/SKILL.md~/.agents/skills/ttj-skills-browser/SKILL.md~/.ttj-skills-browser-installed~/.ttj-skills-browser/.last-update-check
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- `package.json` runs `postinstall` automatically.
- `scripts/install-skill.js` copies bundled skill to `~/.claude/skills/ttj-skills-browser/SKILL.md`.
- The same postinstall writes to `~/.agents/skills/ttj-skills-browser/SKILL.md` and creates `~/.ttj-skills-browser-installed`.
- `dist/cli.js` invokes runtime auto-update before handling normal commands.
- `dist/browser.js` checks `registry.npmjs.org` then runs global `npm install -g ttj-skills-browser@latest` without consent.
Evidence against
- No source reads or transmits environment secrets, credentials, or SSH/cloud files.
- Observed network use is npm update checking and local CDP, not direct data exfiltration.
- Browser evaluation/navigation requires an explicit CLI command after installation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/utils.jsView file
5import path from 'path';
L6: import net from 'net';
L7: import https from 'https';
L8: import { exec } from 'child_process';
L9: import { promisify } from 'util';
...
L17: */
L18: export const getOsType = () => process.platform === 'win32'
L19: ? 'windows'
...
L25: */
L26: export const getHomeDir = () => os.homedir();
L27: /**
...
L33: const isWindows = getOsType() === 'windows';
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/utils.jsView on unpkg · L5•matchType = normalized_sha256
matchedPackage = ttj-sk[redacted]@1.2.17
matchedPath = dist/utils.js
matchedIdentity = npm:dHRqLXNraWxscy1icm93c2Vy:1.2.17
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
1 Critical6 High3 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-skill.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/utils.js
HighKnown Malware Source Similaritydist/utils.js
HighKnown Malware Source Similaritydist/browser.js
HighKnown Malware Source Similaritydist/cli.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ttj-skills-browser@1.2.18.
The versions list below shows the verdict for each recorded version.
- Avoid installing ttj-skills-browser@1.2.18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
11 known versions1.2.18latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 12, 2026, 3:52 AM1.2.17MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 12, 2026, 3:45 AM1.2.16SuspiciousAgent extension lifecycle riskWarnPublishedJul 12, 2026, 1:54 AM1.2.15SuspiciousAgent extension lifecycle riskWarnPublished