registry / @social-data/social-neuron-opinion-query / 1.0.3

@social-data/social-neuron-opinion-query@1.0.3

Social Neuron opinion-query 能力 CLI —— 一能力一命令(social-neuron-opinion-query),薄客户端直达 /opinion-query/{op}。

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic install hook modifies the user's OpenClaw agent skills directory. No user command or consent gate precedes this write.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall execution.

Impact

Installation can alter a broad AI-agent control surface and replace installed skill instructions.

Mechanism

The installer selects the OpenClaw skills directory by default, creates skill subdirectories, and copies bundled files over destination files.

Policy narrative

Installing the package invokes its postinstall hook, which writes bundled skill files into the default OpenClaw skills directory. The copy operation can overwrite existing skill files without an explicit user setup command. This is an unconsented install-time mutation of an AI-agent control surface.

AI rationale

The package performs an automatic postinstall overwrite of the user's OpenClaw skills directory. This meets the install-time AI-agent control-surface mutation block policy.

Evidence

package.jsonbin/install-skills.js~/.openclaw/skills

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

@social-data/social-neuron-opinion-query@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code