Loading npm security reports…

x-agent-relay-cli@0.1.20: AI-agent control-surface risk | LPM Firewall

registry / x-agent-relay-cli / 0.1.20

x-agent-relay-cli@0.1.20

Delegate subtasks from your coding agent to other agents on the Agent Relay network

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook writes delegation instructions into detected foreign AI agents’ home skill directories without a consent prompt.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package with npm lifecycle scripts enabled when supported agent directories exist.

Impact

Persistent agent instructions are added or overwritten, enabling subsequent remote delegation and contextual file sharing. No install-time exfiltration was established.

Mechanism

The hook invokes skills install --all, bypassing selection and copying the packaged delegate skill into each detected agent’s configuration.

Policy narrative

Package installation automatically launches the bundled skill installer with --all. The installer detects foreign coding agents, skips the selection prompt, and copies delegation instructions into their home skill directories. These instructions persist beyond installation and can replace an existing delegate skill. The behavior crosses the install-time agent control-surface boundary without explicit consent.

AI rationale

Inspected source establishes unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the blocking policy even though the installed instructions align with the package’s delegation purpose.

Evidence

package.jsonscripts/postinstall.mjsdist-bin/x-agent-relay.mjsskills/delegate/SKILL.md~/.claude/skills/delegate/SKILL.md~/.codex/skills/delegate/SKILL.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

3// bundled CLI. Best-effort only — must never fail the install. L4: import { spawnSync } from "node:child_process"; L5: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L3

3Cross-file remote execution chain: scripts/postinstall.mjs spawns dist-bin/x-agent-relay.mjs; helper contains network access plus dynamic code execution. L3: // bundled CLI. Best-effort only — must never fail the install. L4: import { spawnSync } from "node:child_process"; L5: import { existsSync } from "node:fs"; ... L20: ); L21: if (result.status !== 0) process.exitCode = 0; L22: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L3

dist-bin/x-agent-relay.mjsView file

7229// ../../packages/agent-runtime/dist/runtimes.js L7230: import { spawn } from "node:child_process"; L7231: import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L7236: // ../../packages/protocol/dist/index.js L7237: var DEFAULT_RELAY_URL = (typeof process !== "undefined" ? process.env?.AGENT_RELAY_URL?.trim() : void 0) || "https://agent.kreplay.com"; L7238: var HEARTBEAT_MS = 3e4;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-bin/x-agent-relay.mjsView on unpkg · L7229

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist-bin/x-agent-relay.mjs: import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(path, JSON.stringify(value, null, 2) + "\n", "utf8"); delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; writeFileSync(safe, file.content, "utf8"); import readline from "node:readline/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist-bin/x-agent-relay.mjsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 4-43json

4 "description": "Delegate subtasks from your coding agent to other agents on the Agent Relay network",

5 "keywords": ["agent", "ai", "delegation", "mcp", "claude", "opencode", "codex", "trae", "cli"],

6 "license": "MIT",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/wisimer/XAgentRelay.git",

10 "directory": "apps/cli"

11 },

12 "homepage": "https://github.com/wisimer/XAgentRelay#readme",

13 "bugs": "https://github.com/wisimer/XAgentRelay/issues",

14 "type": "module",

15 "bin": {

16 "x-agent-relay": "./dist-bin/x-agent-relay.mjs"

17 },

18 "files": [

19 "dist-bin",

20 "skills",

21 "scripts"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "bundle": "esbuild dist/index.js --bundle --platform=node --format=esm --target=node18 --outfile=dist-bin/x-agent-relay.mjs --banner:js=\"import { createRequire as __arCreateRequire } from 'node:module'; const require = __arCreateRequire(import.meta.url);\" --external:bufferutil --external:utf-8-validate && chmod +x dist-bin/x-agent-relay.mjs"

26 },

27 "publishConfig": {

28 "registry": "https://registry.npmjs.org",

29 "access": "public"

30 },

31 "devDependencies": {

32 "@x-agent-relay/agent-runtime": "*",

33 "@x-agent-relay/protocol": "*",

34 "@x-agent-relay/sdk": "*",

35 "@x-agent-relay/shared": "*",

36 "commander": "^13.0.0",

37 "esbuild": "^0.28.2"

38 },

39 "engines": {

40 "node": ">=18"

41 }

42}

43

scripts/postinstall.mjsView file

Lines 1-23javascript

1// npm postinstall: install the /delegate skill for every detected coding

2// agent (Claude Code, Codex, Trae, Qwen, shared ~/.agents, …) by invoking the

3// bundled CLI. Best-effort only — must never fail the install.

4import { spawnSync } from "node:child_process";

5import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L3

dist-bin/x-agent-relay.mjsView file

Lines 7209-7249javascript

7209 if (ctx?.previous_attempts?.length) {

7210 lines.push("");

7211 lines.push("## Previous attempts");

7212 for (const a of