registry / AI-agent control-surface risk / @clickzetta/cz-cli
@clickzetta/cz-cli
AI-Agent-friendly CLI for ClickZetta Lakehouse
This report shows the evidence for @clickzetta/cz-cli@1.17.10. 2 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe lifecycle hook performs unconsented postinstall writes to foreign/broad AI-agent skill directories, meeting the blocking policy. The absence of visible exfiltration does not mitigate this concrete control-surface modification.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
Unconsented AI-agent capability/control-surface modification for Claude, Kiro, Cursor, Codex, OpenClaw, and SingClaw.
Mechanism
downloads platform payload and replaces external AI-agent skills
Policy narrative
On installation, postinstall can fetch and extract a platform-specific package, then silently remove legacy skills and replace/install cz-cli skills in several unrelated AI-agent directories. This is automatic broad external agent control-surface mutation.
AI rationale
The lifecycle hook performs unconsented postinstall writes to foreign/broad AI-agent skill directories, meeting the blocking policy. The absence of visible exfiltration does not mitigate this concrete control-surface modification.
Evidence
package.jsonbin/postinstall.jsbin/platform.js~/.claude/skills~/.kiro/skills~/.cursor/skills~/.codex/skills~/.openclaw/workspace/skills~/.singclaw/workspace/skills
Network endpoints1
registry.npmjs.org/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs bin/postinstall.js automatically.
- bin/postinstall.js installs into six third-party AI-agent skill directories.
- It deletes legacy skills and replaces each cz-cli skill without user action.
- Postinstall downloads a platform package via npm pack, extracts it, then copies its skill payload.
Evidence against
- No credential harvesting or explicit exfiltration appears in inspected JS.
- The registry fetch is limited to ClickZetta platform-package names and version.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/postinstall.jsView file
80const agentDirs = [
L81: path.join(home, ".claude", "skills"),
L82: path.join(home, ".kiro", "skills"),
L83: path.join(home, ".cursor", "skills"),
L84: path.join(home, ".codex", "skills"),
L85: path.join(home, ".openclaw", "workspace", "skills"),
...
L98: try {
L99: fs.mkdirSync(dir, { recursive: true });
L100: fs.rmSync(path.join(dir, "cz-cli"), { recursive: true, force: true });
L101: fs.cpSync(externalSkillSrc, path.join(dir, "cz-cli"), { recursive: true });
L102: } catch (e) {}
...
L107: fs.rmSync(builtinDest, { recursive: true, force: true });
Findings
1 Critical1 High3 Medium2 Low
CriticalAi Agent Control Hijackbin/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @clickzetta/cz-cli@1.17.10.
The versions list below shows the verdict for each recorded version.
- Avoid installing @clickzetta/cz-cli@1.17.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.