Loading npm security reports…

@kg-ai/kugou-skill@0.1.6: AI-agent control-surface risk | LPM Firewall

registry / @kg-ai/kugou-skill / 0.1.6

@kg-ai/kugou-skill@0.1.6

Kugou Skill CLI

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates existing Claude, Codex, and other agent skill control surfaces without an explicit user command. The installed skill instructs agents to solicit and pass user authentication secrets to the bundled CLI.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation on a host with any targeted agent skill parent directory

Impact

Unconsented persistence in multiple AI-agent instruction surfaces, enabling later secret solicitation.

Mechanism

postinstall deployment of a cross-agent credential-handling skill

Policy narrative

Installing the package automatically places its instruction file and references into every detected AI-agent skill directory. That skill directs agents to ask users for a base64 authentication secret when QR rendering is unavailable, then invoke the bundled CLI with it. This is an unconsented postinstall mutation of foreign, broad agent control surfaces.

Rationale

Source inspection confirms the lifecycle script deploys package-controlled instructions across multiple unrelated agent platforms. This satisfies the firewall block criterion for unconsented postinstall AI-agent control-surface mutation.

Evidence

package.jsonscripts/install.jsSKILL.mdbin/linux-x64/kugou-cli~/.claude/skills/kugou-skill/SKILL.md~/.mavis/skills/kugou-skill/SKILL.md~/.hermes/skills/kugou-skill/SKILL.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

32L33: fs.copyFileSync(srcBin, destBin); L34: fs.chmodSync(destBin, 0o755); ... L39: const skillDirs = [ L40: path.join(os.homedir(), '.claude', 'skills', 'kugou-skill'), L41: path.join(os.homedir(), '.mavis', 'skills', 'kugou-skill'), ... L43: path.join(os.homedir(), '.openclaw', 'skills', 'kugou-skill'), L44: path.join(os.homedir(), '.codex', 'skills', 'kugou-skill'), L45: path.join(os.homedir(), '.workbuddy', 'skills', 'kugou-skill'), ... L56: if (!fs.existsSync(skillDir)) { L57: fs.mkdirSync(skillDir, { recursive: true }); L58: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L32

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.7 matchedPath = scripts/install.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

bin/linux-arm64/kugou-cliView file

•path = bin/linux-arm64/kugou-cli kind = native_binary sizeBytes = 7864504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/linux-arm64/kugou-cliView on unpkg

scripts/build-all.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.7 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-all.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = aa9b71982f858c22 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kg-ai/kugou-skill@0.1.7 matchedPath = scripts/build-all.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.7 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build-all.jsView on unpkg

scripts/run.jsView file

•matchType = normalized_sha256 matchedPackage = @kg-ai/kugou-skill@0.1.7 matchedPath = scripts/run.js matchedIdentity = npm:QGtnLWFpL2t1Z291LXNraWxs:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg