Loading npm security reports…

@kg-ai/kugou-skill@0.1.16: AI-agent control-surface risk | LPM Firewall

registry / @kg-ai/kugou-skill / 0.1.16

@kg-ai/kugou-skill@0.1.16

Kugou Skill CLI

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook mutates existing skill roots for multiple AI-agent products. It installs package-controlled instruction files that those agents may load.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the npm package runs postinstall automatically.

Impact

It can alter the instructions and capabilities available to several locally installed AI agents without an explicit setup command.

Mechanism

Postinstall copies skill content into multiple AI-agent skill directories.

Policy narrative

On installation, npm runs scripts/install.js. The script detects pre-existing skill roots for Claude, Mavis, Hermes, OpenClaw, Codex, and WorkBuddy, then creates package skill folders and writes SKILL.md plus reference documents there. This is an unconsented postinstall change to broad foreign AI-agent control surfaces; subsequent agents may load the package-controlled instructions.

AI rationale

The automatic lifecycle hook writes package-controlled instructions into multiple foreign AI-agent skill directories. This meets the install-time AI-agent control-surface mutation block policy even though no JavaScript exfiltration was found.

Evidence

package.jsonscripts/install.jsbin/kugou-cli~/.claude/skills/kugou-skill/SKILL.md~/.mavis/skills/kugou-skill/SKILL.md~/.hermes/skills/kugou-skill/SKILL.md~/.openclaw/skills/kugou-skill/SKILL.md

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

32L33: fs.copyFileSync(srcBin, destBin); L34: fs.chmodSync(destBin, 0o755); ... L39: const skillDirs = [ L40: path.join(os.homedir(), '.claude', 'skills', 'kugou-skill'), L41: path.join(os.homedir(), '.mavis', 'skills', 'kugou-skill'), ... L43: path.join(os.homedir(), '.openclaw', 'skills', 'kugou-skill'), L44: path.join(os.homedir(), '.codex', 'skills', 'kugou-skill'), L45: path.join(os.homedir(), '.workbuddy', 'skills', 'kugou-skill'), ... L76: if (!fs.existsSync(skillDir)) { L77: fs.mkdirSync(skillDir, { recursive: true }); L78: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L32

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/install.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @kg-ai/kugou-skill@0.1.4 matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.4 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg

bin/linux-arm64/kugou-cliView file

•path = bin/linux-arm64/kugou-cli kind = native_binary sizeBytes = 8716448 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/linux-arm64/kugou-cliView on unpkg

scripts/build-all.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-all.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0900e8ca3edd1bc0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build-all.jsView on unpkg

scripts/run.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/run.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-28json

1{

2 "name": "@kg-ai/kugou-skill",

3 "version": "0.1.16",

4 "description": "Kugou Skill CLI",

5 "main": "index.js",

6 "bin": {

7 "kugou-cli": "./scripts/run.js"

8 },

9 "scripts": {

10 "postinstall": "node ./scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "keywords": [

13 "cli",

14 "kugou"

15 ],

16 "files": [

17 "bin",

18 "scripts",

19 "SKILL.md",

20 "references"

21 ],

22 "author": "",

23 "license": "MIT",

24 "engines": {

25 "node": ">=16"

26 }

27}

28

scripts/install.jsView file

Lines 12-52javascript

12 'darwin': { dir: `darwin-${arch}`, exe: 'kugou-cli' },

13 'linux': { dir: `linux-${arch}`, exe: 'kugou-cli' },

14 'win32': { dir: `win32-x64`, exe: 'kugou-cli.exe' }

bin/linux-arm64/kugou-cliView file

•path = bin/linux-arm64/kugou-cli kind = native_binary sizeBytes = 8716448 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/linux-arm64/kugou-cliView on unpkg

scripts/build-all.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-all.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0900e8ca3edd1bc0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build-all.jsView on unpkg

scripts/run.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.14 matchedPath = scripts/run.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg