Loading npm security reports…

@kg-ai/kugou-skill@0.1.10: AI-agent control-surface risk | LPM Firewall

registry / @kg-ai/kugou-skill / 0.1.10

@kg-ai/kugou-skill@0.1.10

Kugou Skill CLI

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically implants this package's skill into installed Claude, Mavis, Hermes, OpenClaw, Codex, and WorkBuddy control surfaces. It creates package directories and copies agent instructions without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation on a system where any targeted agent skills parent directory exists

Impact

Unconsented persistence and behavioral influence across foreign AI-agent environments.

Mechanism

postinstall multi-agent skill deployment

Policy narrative

Installing the npm package executes scripts/install.js. If any of six unrelated agent skill parent directories already exist, it creates a kugou-skill subdirectory and copies SKILL.md plus references into it. This silently adds package-controlled instructions to multiple agent runtimes; those instructions direct agents to use the bundled CLI and accept user-provided login secrets. The behavior is automatic rather than an explicit setup command.

Rationale

Source confirms an unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the firewall block policy regardless of the installer’s lack of network activity.

Evidence

package.jsonscripts/install.jsSKILL.mdreferences/install.mdreferences/*bin/kugou-cli~/.claude/skills/kugou-skill/~/.mavis/skills/kugou-skill/

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

32L33: fs.copyFileSync(srcBin, destBin); L34: fs.chmodSync(destBin, 0o755); ... L39: const skillDirs = [ L40: path.join(os.homedir(), '.claude', 'skills', 'kugou-skill'), L41: path.join(os.homedir(), '.mavis', 'skills', 'kugou-skill'), ... L43: path.join(os.homedir(), '.openclaw', 'skills', 'kugou-skill'), L44: path.join(os.homedir(), '.codex', 'skills', 'kugou-skill'), L45: path.join(os.homedir(), '.workbuddy', 'skills', 'kugou-skill'), ... L56: if (!fs.existsSync(skillDir)) { L57: fs.mkdirSync(skillDir, { recursive: true }); L58: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L32

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.9 matchedPath = scripts/install.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

bin/linux-arm64/kugou-cliView file

•path = bin/linux-arm64/kugou-cli kind = native_binary sizeBytes = 7930040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/linux-arm64/kugou-cliView on unpkg

scripts/build-all.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.9 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-all.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = aa9b71982f858c22 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kg-ai/kugou-skill@0.1.9 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.9 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build-all.jsView on unpkg

scripts/run.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.9 matchedPath = scripts/run.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg