Loading npm security reports…
Social Neuron metadata-query 能力 CLI —— 一能力一命令(social-neuron-metadata-query),薄客户端直达 /metadata-query/{op}。
LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically installs or replaces the package's own OpenClaw skill. This establishes an extension lifecycle risk, but no confirmed malicious attack was identified.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json automatically runs bin/install-skills.js after installation.
package.jsonView on unpkg · L16Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13The installer targets OPENCLAW_SKILLS_DIR or the user's .openclaw/skills directory.
bin/install-skills.jsView on unpkg · L11The installer creates extension directories and overwrites bundled files without an opt-in check.
bin/install-skills.jsView on unpkg · L19This report applies to @social-data/social-neuron-metadata-query@1.0.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L17package.json automatically runs bin/install-skills.js after installation.
package.jsonView on unpkg · L16Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L13The installer targets OPENCLAW_SKILLS_DIR or the user's .openclaw/skills directory.
bin/install-skills.jsView on unpkg · L11The installer creates extension directories and overwrites bundled files without an opt-in check.
bin/install-skills.jsView on unpkg · L19