Loading npm security reports…

@kg-ai/kugou-skill@0.1.12: AI-agent control-surface risk | LPM Firewall

registry / @kg-ai/kugou-skill / 0.1.12

@kg-ai/kugou-skill@0.1.12

Kugou Skill CLI

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies multiple third-party AI-agent skill control surfaces. It deploys package-authored instructions and references for later agent loading.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, through postinstall

Impact

Unconsented persistence of package-controlled instructions across several AI-agent environments.

Mechanism

Automatic cross-agent skill installation

Policy narrative

During npm postinstall, the package selects a platform binary and then scans several agent-specific home-directory skill roots. Where a root exists, it creates a kugou-skill directory and copies SKILL.md plus reference documents there. This persists package-authored agent behavior without an explicit user command and affects Claude, Mavis, Hermes, OpenClaw, Codex, and WorkBuddy control surfaces.

AI rationale

The automatic postinstall hook broadly mutates foreign AI-agent control surfaces, which meets the install-control-surface blocking policy. The absence of a JavaScript network request does not remove the persistence and control-hijack risk.

Evidence

package.jsonscripts/install.jsbin/kugou-cliSKILL.mdreferences/*~/.claude/skills/kugou-skill~/.mavis/skills/kugou-skill~/.hermes/skills/kugou-skill~/.openclaw/skills/kugou-skill

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

32L33: fs.copyFileSync(srcBin, destBin); L34: fs.chmodSync(destBin, 0o755); ... L39: const skillDirs = [ L40: path.join(os.homedir(), '.claude', 'skills', 'kugou-skill'), L41: path.join(os.homedir(), '.mavis', 'skills', 'kugou-skill'), ... L43: path.join(os.homedir(), '.openclaw', 'skills', 'kugou-skill'), L44: path.join(os.homedir(), '.codex', 'skills', 'kugou-skill'), L45: path.join(os.homedir(), '.workbuddy', 'skills', 'kugou-skill'), ... L61: if (!fs.existsSync(skillDir)) { L62: fs.mkdirSync(skillDir, { recursive: true }); L63: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L32

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.13 matchedPath = scripts/install.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @kg-ai/kugou-skill@0.1.19 matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.19 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg

bin/linux-arm64/kugou-cliView file

•path = bin/linux-arm64/kugou-cli kind = native_binary sizeBytes = 7995576 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/linux-arm64/kugou-cliView on unpkg

scripts/build-all.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.20 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-all.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a9c42b91c4bed2ad signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kg-ai/kugou-skill@0.1.13 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.13 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build-all.jsView on unpkg

scripts/run.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.20 matchedPath = scripts/run.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-28json

1{

2 "name": "@kg-ai/kugou-skill",

3 "version": "0.1.12",

4 "description": "Kugou Skill CLI",

5 "main": "index.js",

6 "bin": {

7 "kugou-cli": "./scripts/run.js"

8 },

9 "scripts": {

10 "postinstall": "node ./scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "keywords": [

13 "cli",

14 "kugou"

15 ],

16 "files": [

17 "bin",

18 "scripts",

19 "SKILL.md",

20 "references"

21 ],

22 "author": "",

23 "license": "MIT",

24 "engines": {

25 "node": ">=16"

26 }

27}

28

scripts/install.jsView file

32L33: fs.copyFileSync(srcBin, destBin); L34: fs.chmodSync(destBin, 0o755); ... L39: const skillDirs = [ L40: path.join(os.homedir(), '.claude', 'skills', 'kugou-skill'), L41: path.join(os.homedir(), '.mavis', 'skills', 'kugou-skill'), ... L43: path.join(os.homedir(), '.openclaw', 'skills', 'kugou-skill'), L44: path.join(os.homedir(), '.codex', 'skills', 'kugou-skill'), L45: path.join(os.homedir(), '.workbuddy', 'skills', 'kugou-skill'), ... L61: if (!fs.existsSync(skillDir)) { L62: fs.mkdirSync(skillDir, { recursive: true }); L63: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L32

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.13 matchedPath = scripts/install.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @kg-ai/kugou-skill@0.1.19 matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.19 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/linux-arm64/kugou-cliView file

•path = bin/linux-arm64/kugou-cli kind = native_binary sizeBytes = 7995576 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/linux-arm64/kugou-cliView on unpkg

scripts/build-all.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.20 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-all.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a9c42b91c4bed2ad signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kg-ai/kugou-skill@0.1.13 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.13 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build-all.jsView on unpkg

scripts/run.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.20 matchedPath = scripts/run.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg