Loading npm security reports…
Social Neuron metadata-query 能力 CLI —— 一能力一命令(social-neuron-metadata-query),薄客户端直达 /metadata-query/{op}。
LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall writes this package's OpenClaw skill into the user's OpenClaw skills directory. That directory is a foreign agent instruction surface, and the write happens without a separate user command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json postinstall runs node bin/install-skills.js on npm install with no user prompt.
package.jsonView on unpkg · L16Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13install-skills.js copies bundled skill files into OPENCLAW_SKILLS_DIR or ~/.openclaw/skills, creating directories and overwriting files.
bin/install-skills.jsView on unpkg · L11install-skills.js copies bundled skill files into OPENCLAW_SKILLS_DIR or ~/.openclaw/skills, creating directories and overwriting files.
bin/install-skills.jsView on unpkg · L19This report applies to @social-data/social-neuron-metadata-query@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L17package.json postinstall runs node bin/install-skills.js on npm install with no user prompt.
package.jsonView on unpkg · L16Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13install-skills.js copies bundled skill files into OPENCLAW_SKILLS_DIR or ~/.openclaw/skills, creating directories and overwriting files.
bin/install-skills.jsView on unpkg · L11install-skills.js copies bundled skill files into OPENCLAW_SKILLS_DIR or ~/.openclaw/skills, creating directories and overwriting files.
bin/install-skills.jsView on unpkg · L19