postinstall installs Ark skills into shared agent directories without separate confirmation

Ouverte
  • Quelque chose ne va pas ?
#27 0 commentaires 1 réaction 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
48/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
javascript, node.js
Domaine
cli, developer-experience

Piste de recherche

Start in scripts/postinstall.js at lines 60, 216, and 344, then review the related consent concern in issue #24. Reproduce an install or update and verify that connecting does not modify every detected agent directory without explicit confirmation or a selected target; document the opt-out and affected paths when applicable.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Summary

Installing or updating @volcengine/ark-cli runs an npm postinstall hook that automatically executes +connect --refresh without a separate user confirmation. The connect flow detects agent environments and installs the full Ark CLI skill bundle into their skill locations. In the observed setup, 25 skills were installed under the shared ~/.agents/skills directory.

Codex subsequently discovered those skills and included their names and descriptions in the <skills_instructions> developer message of later sessions. Package installation therefore changed persistent configuration consumed by another agent harness, with a recurring downstream context payload.

Verified on 1.0.33; the relevant postinstall implementation is byte-identical through 1.0.36, the latest stable release.

Related: #24 reported the same postinstall +connect --refresh behavior on v1.0.23 and raised the opt-in/consent concern.

This issue adds two pieces of follow-up evidence rather than intending to duplicate that report:

  • the relevant postinstall implementation was verified on 1.0.33 and is byte-identical through 1.0.36 (latest stable);
  • the downstream Codex impact was measured directly from rollout files: 30 affected sessions, 33 <skills_instructions> injections, and 439,579 B attributable to the 25 Ark skill entries.

Happy for maintainers to track the underlying fix under #24 if preferred; the measurements here are intended as additional impact evidence.

Trigger mechanism

At scripts/postinstall.js:344, the hook calls:

execFileSync(binPath, ["+connect", "--refresh"])

The hook skips CI environments (scripts/postinstall.js:216), and ARKCLI_SKIP_POSTINSTALL=1 is available (scripts/postinstall.js:60). The CLI also has a --path capability for a targeted installation, but the automatic connect path does not use it to limit the target agent.

Measured downstream impact

In the September 21–29, 2026 observation window, 30 sessions were affected across 161 rollouts in the relevant statistics scope. There were 33 <skills_instructions> injections: 27 sessions had one and three sessions had two, consistent with a resumed session receiving the metadata again. All 33 injections contained the 25 Ark skill entries.

Measurement Observed value
Complete <skills_instructions> developer message 22,646–51,365 B per injection
Complete message median 46,970 B
Complete messages across 33 injections 1,511,925 B
Ark skill entries attributable median 13,387 B per injection
Ark skill entries attributable total 439,579 B

The 25 Ark skill descriptions contain 7,406 characters in one copy. Depending on tokenizer, the attributable payload corresponds roughly to 3.5K–5.5K tokens per injection, or 115K–180K tokens across the 33 observed injections. These token figures are estimates; the byte measurements above are the primary evidence.

No Ark CLI skill invocation was observed in the audited logs (1,929 Antigravity command log entries and 255 Codex rollouts).

Why this behavior is surprising

The user action was to install or update one CLI package. The lifecycle hook also modified persistent skill configuration automatically consumed by other agent harnesses. The scope of that side effect is broader than the package installation makes visible to the user.

In agent harnesses, skill descriptions can become recurring prompt context rather than passive files on disk. This makes the default installation behavior relevant to future sessions even when no Ark CLI skill is invoked.

Reproduction / evidence anchors

Two local Codex rollout anchors from the frozen evidence set illustrate the developer-message payload:

  • rollout-2026-09-21T23-12-33-*.jsonl:3: complete <skills_instructions> message, 51,109 B.
  • rollout-2026-09-22T03-28-51-*.jsonl:277: complete <skills_instructions> message, 22,646 B.

To inspect this in a Codex rollout, find <skills_instructions>, confirm the record is a response_item with role=developer, identify the Ark skill entries, and measure both the complete message bytes and the bytes attributable to those entries. The private rollout and conversation contents are not included here.

Suggested fixes

  1. Explicit opt-in or scoped installation. Avoid modifying every detected agent environment by default during postinstall. For example, prompt the user to run arkcli +connect, request confirmation before the first connect, require selection of a target agent, or use the existing --path capability for a scoped installation.
  2. Slim metadata and progressive disclosure. Provide shorter auto-discovery descriptions or a slim skill index, with full descriptions loaded only after a skill is selected.
  3. Clearer installation disclosure. If automatic connect remains, show the detected agents, modified paths, skill count, opt-out method, and uninstall method in the installation output.
Langage dominant
jq
Étoiles
147
Forks
18
Aucune PR mergée en 30 j

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de volcengine/ark-cli

Toutes les issues de volcengine/ark-cli

Issues similaires

Plus d'issues CLI

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.