registry / @social-data/social-neuron-subscription / 1.0.2

@social-data/social-neuron-subscription@1.0.2

Social Neuron subscription 能力 CLI —— 一能力一命令(social-neuron-subscription),薄客户端直达 /subscription/{op}。

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically installs or overwrites this package's OpenClaw skill. This creates an agent extension lifecycle risk, but no confirmed malicious attack was established.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall, or the explicit CLI skills install command.

Impact

The package's agent instructions can be installed or replaced automatically without a separate setup command.

Mechanism

The installer copies bundled skill files into OPENCLAW_SKILLS_DIR or the user's .openclaw/skills directory.

AI rationale

The automatic skill installation warrants a warning under the policy for package-owned agent extension setup. Inspected executable source does not establish malicious behavior or broad agent control hijacking.

Evidence

package.jsonbin/install-skills.jsskills/social-neuron-subscription/SKILL.md.openclaw/skills/social-neuron-subscription/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json automatically runs bin/install-skills.js after installation.

@social-data/social-neuron-subscription@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code