Loading npm security reports…
Social Neuron metadata-query 能力 CLI —— 一能力一命令(social-neuron-metadata-query),薄客户端直达 /metadata-query/{op}。
LPM flags this version as an AI-agent control-surface risk. npm postinstall copies this package's OpenClaw skill into the user OpenClaw skills directory, overwriting files there. That directory is a foreign agent control surface, and the write is not gated by an explicit user command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json postinstall runs node bin/install-skills.js on every install.
package.jsonView on unpkg · L16Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13installTo writes into OPENCLAW_SKILLS_DIR or the user home ~/.openclaw/skills directory with no consent prompt.
bin/install-skills.jsView on unpkg · L11It mkdir and copyFileSync-overwrites every bundled skill file into that agent skills directory.
bin/install-skills.jsView on unpkg · L19This report applies to @social-data/social-neuron-metadata-query@1.0.0-beta.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L17package.json postinstall runs node bin/install-skills.js on every install.
package.jsonView on unpkg · L16Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13installTo writes into OPENCLAW_SKILLS_DIR or the user home ~/.openclaw/skills directory with no consent prompt.
bin/install-skills.jsView on unpkg · L11It mkdir and copyFileSync-overwrites every bundled skill file into that agent skills directory.
bin/install-skills.jsView on unpkg · L19