registry / ttj-skills-browser / 1.2.6

ttj-skills-browser@1.2.6

ttj-skills-browser - Playwright CLI with auto-profile management

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installation mutates global Claude Code and Codex agent-skill directories. This occurs automatically during npm postinstall, before the user invokes the CLI.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

`npm install` executes the package postinstall lifecycle hook.

Impact

Adds package-controlled instructions to broad user-level AI-agent control surfaces.

Mechanism

Unconsented global AI-agent skill installation.

Policy narrative

On installation, npm invokes `scripts/install-skill.js`. The script copies the package-supplied skill into the user's global Claude Code skill directory and writes a converted version into the global Codex agent skill directory, then writes an installation marker. These are foreign, broad AI-agent control surfaces changed without an explicit user command.

Rationale

The package contains a concrete unconsented `postinstall` mutation of global AI-agent instruction directories. Under the install-control-surface policy, this warrants blocking even though no credential theft or exfiltration was found.

Evidence

package.jsonscripts/install-skill.js.claude/skills/ttj-skills-browser/SKILL.md~/.claude/skills/ttj-skills-browser/SKILL.md~/.agents/skills/ttj-skills-browser/SKILL.md~/.ttj-skills-browser-installed

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `postinstall: node scripts/install-skill.js`.
`scripts/install-skill.js` unconditionally copies packaged `SKILL.md` to `~/.claude/skills/ttj-skills-browser/SKILL.md`.
The same postinstall writes a converted skill to `~/.agents/skills/ttj-skills-browser/SKILL.md`.
Postinstall also creates `~/.ttj-skills-browser-installed` without user invocation.

Evidence against

Installer does not read credentials or transmit data.
No obfuscated payload, dynamic code loading, or remote execution was found.
Runtime network use is package-aligned: npm version lookup and browser launch.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 37.7 KB of source, external domains: 127.0.0.1, registry.npmjs.org, www.google.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-39json

2 "name": "ttj-skills-browser",

3 "version": "1.2.6",

4 "description": "ttj-skills-browser - Playwright CLI with auto-profile management",

5 "type": "module",

6 "bin": {

7 "ttj-skills-browser": "dist/cli.js"

8 },

9 "main": "./dist/cli.js",

10 "files": [

11 "dist",

12 ".claude/skills",

13 "scripts"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "start": "node dist/cli.js",

18 "prepare": "npm run build",

19 "postinstall": "node scripts/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "chalk": "^5.3.0"

23 },

24 "devDependencies": {

25 "typescript": "^5.4.0",

26 "@types/node": "^20.11.0"

27 },

28 "keywords": [

29 "playwright",

30 "browser",

31 "automation",

32 "cli"

33 ],

34 "author": "TTJ",

35 "license": "MIT",

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/ddoojoang/ttj-skills-browser.git"

39 },

dist/utils.jsView file

Lines 1-25javascript

1/**

2 * ttj-skills-browser - Utility functions (pure where possible)

3 */

4import os from 'os';

5import path from 'path';

6import net from 'net';

7import https from 'https';

scripts/install-skill.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Claude Code / Codex 스킬 자동 설치

4 * npm install 후 Claude Code와 Codex의 사용자 전역 스킬 위치에 복사합니다.

5 */

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/utils.jsView file

5import path from 'path'; L6: import net from 'net'; L7: import https from 'https'; L8: import { exec, execFile } from 'child_process'; L9: import { promisify } from 'util'; ... L19: */ L20: export const getOsType = () => process.platform === 'win32' L21: ? 'windows' ... L27: */ L28: export const getHomeDir = () => os.homedir(); L29: /** ... L35: const isWindows = getOsType() === 'windows';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils.jsView on unpkg · L5

scripts/install-skill.jsView file

14Install-time AI-agent control hijack evidence: L14: const skillName = 'ttj-sk[redacted]'; L15: const sk[redacted] = path.join(__dirname, '..', '.claude', 'skills', skillName); L16: const skillFile = 'SKILL.md'; ... L19: if (!fs.existsSync(dir)) { L20: fs.mkdirSync(dir, { recursive: true }); L21: } ... L43: // Claude Code: 기존 /ttj-sk[redacted] 호출 방식 유지 L44: const claudeTargetDir = path.join(homedir(), '.claude', 'skills', skillName); L45: const claudeTargetFile = path.join(claudeTargetDir, skillFile); L46: ensureDir(claudeTargetDir); L47: fs.copyFileSync(sourceFile, claudeTargetFile); L48: console.log(`✅ Claude Code 스킬 설치 완료: ${claudeTargetFile}`); Payload evidence from .claude/skills/ttj-sk[redacted]/SKILL.md: L133: L134: **HTTP 요청**: Axios + Cheerio 조합 L135: - Axios: HTTP 요청 수행 ... L270: L271: ```powershell L272: # Windows PowerShell

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.jsView on unpkg · L14

Findings

1 Critical2 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skill.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/utils.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 1-39json

2 "name": "ttj-skills-browser",

3 "version": "1.2.6",

4 "description": "ttj-skills-browser - Playwright CLI with auto-profile management",

5 "type": "module",

6 "bin": {

7 "ttj-skills-browser": "dist/cli.js"

8 },

9 "main": "./dist/cli.js",

10 "files": [

11 "dist",

12 ".claude/skills",

13 "scripts"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "start": "node dist/cli.js",

18 "prepare": "npm run build",

19 "postinstall": "node scripts/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "chalk": "^5.3.0"

23 },

24 "devDependencies": {

25 "typescript": "^5.4.0",

26 "@types/node": "^20.11.0"

27 },

28 "keywords": [

29 "playwright",

30 "browser",

31 "automation",

32 "cli"

33 ],

34 "author": "TTJ",

35 "license": "MIT",

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/ddoojoang/ttj-skills-browser.git"

39 },

dist/utils.jsView file

Lines 1-25javascript

1/**

2 * ttj-skills-browser - Utility functions (pure where possible)

3 */

4import os from 'os';

5import path from 'path';

6import net from 'net';

7import https from 'https';

scripts/install-skill.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Claude Code / Codex 스킬 자동 설치

4 * npm install 후 Claude Code와 Codex의 사용자 전역 스킬 위치에 복사합니다.

5 */

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';