Loading npm security reports…

x-agent-relay-cli@0.1.19: AI-agent control-surface risk | LPM Firewall

registry / x-agent-relay-cli / 0.1.19

x-agent-relay-cli@0.1.19

Delegate subtasks from your coding agent to other agents on the Agent Relay network

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook installs delegation instructions across detected foreign AI agents without prompting. It can overwrite an existing global delegate skill.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the npm package with lifecycle scripts enabled when supported agent directories exist.

Impact

Persistent changes to foreign agents' available instructions and delegation behavior without separate consent.

Mechanism

The hook invokes skills install --all, bypasses the selection prompt, and copies SKILL.md into each detected agent's global skills directory.

Policy narrative

Package installation automatically invokes the bundled skill installer with --all. That option skips its interactive picker and installs the packaged remote delegation instructions into detected global agent directories. The copy operation overwrites existing delegate skills. This crosses a broad foreign agent control surface during npm installation without an explicit setup command or consent prompt.

AI rationale

Inspected source establishes unconsented postinstall mutation of foreign and shared AI-agent control surfaces, which meets the blocking policy. Blocking rests on the automatic instruction installation, not scanner claims about credentials or ordinary relay networking.

Evidence

package.jsonscripts/postinstall.mjsdist-bin/x-agent-relay.mjsskills/delegate/SKILL.md.claude/skills/delegate/SKILL.md.codex/skills/delegate/SKILL.md.agents/skills/delegate/SKILL.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

3// bundled CLI. Best-effort only — must never fail the install. L4: import { spawnSync } from "node:child_process"; L5: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L3

3Cross-file remote execution chain: scripts/postinstall.mjs spawns dist-bin/x-agent-relay.mjs; helper contains network access plus dynamic code execution. L3: // bundled CLI. Best-effort only — must never fail the install. L4: import { spawnSync } from "node:child_process"; L5: import { existsSync } from "node:fs"; ... L20: ); L21: if (result.status !== 0) process.exitCode = 0; L22: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L3

dist-bin/x-agent-relay.mjsView file

7229// ../../packages/agent-runtime/dist/runtimes.js L7230: import { spawn } from "node:child_process"; L7231: import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L7236: // ../../packages/protocol/dist/index.js L7237: var DEFAULT_RELAY_URL = (typeof process !== "undefined" ? process.env?.AGENT_RELAY_URL?.trim() : void 0) || "https://agent.kreplay.com"; L7238: var HEARTBEAT_MS = 3e4;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-bin/x-agent-relay.mjsView on unpkg · L7229

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist-bin/x-agent-relay.mjs: import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(path, JSON.stringify(value, null, 2) + "\n", "utf8"); delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; writeFileSync(safe, file.content, "utf8"); import readline from "node:readline/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist-bin/x-agent-relay.mjsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 4-43json

4 "description": "Delegate subtasks from your coding agent to other agents on the Agent Relay network",

5 "keywords": ["agent", "ai", "delegation", "mcp", "claude", "opencode", "codex", "trae", "cli"],

6 "license": "MIT",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/wisimer/XAgentRelay.git",

10 "directory": "apps/cli"

11 },

12 "homepage": "https://github.com/wisimer/XAgentRelay#readme",

13 "bugs": "https://github.com/wisimer/XAgentRelay/issues",

14 "type": "module",

15 "bin": {

16 "x-agent-relay": "./dist-bin/x-agent-relay.mjs"

17 },

18 "files": [

19 "dist-bin",

20 "skills",

21 "scripts"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "bundle": "esbuild dist/index.js --bundle --platform=node --format=esm --target=node18 --outfile=dist-bin/x-agent-relay.mjs --banner:js=\"import { createRequire as __arCreateRequire } from 'node:module'; const require = __arCreateRequire(import.meta.url);\" --external:bufferutil --external:utf-8-validate && chmod +x dist-bin/x-agent-relay.mjs"

26 },

27 "publishConfig": {

28 "registry": "https://registry.npmjs.org",

29 "access": "public"

30 },

31 "devDependencies": {

32 "@x-agent-relay/agent-runtime": "*",

33 "@x-agent-relay/protocol": "*",

34 "@x-agent-relay/sdk": "*",

35 "@x-agent-relay/shared": "*",

36 "commander": "^13.0.0",

37 "esbuild": "^0.28.2"

38 },

39 "engines": {

40 "node": ">=18"

41 }

42}

43

scripts/postinstall.mjsView file

Lines 1-23javascript

1// npm postinstall: install the /delegate skill for every detected coding

2// agent (Claude Code, Codex, Trae, Qwen, shared ~/.agents, …) by invoking the

3// bundled CLI. Best-effort only — must never fail the install.

4import { spawnSync } from "node:child_process";

5import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L3

dist-bin/x-agent-relay.mjsView file

Lines 7209-7249javascript

7209 if (ctx?.previous_attempts?.length) {

7210 lines.push("");

7211 lines.push("## Previous attempts");

7212 for (const a of