registry / AI-agent control-surface risk / @sokeai/cli

@sokeai/cli

授客AI官方CLI工具 - 支持AI Agent Skills

This report shows the evidence for @sokeai/cli@1.0.79. 3 of 34 known versions are blocked or flagged. The newest version, 1.0.116, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an unconsented postinstall mutation of multiple external AI-agent control surfaces, combined with execution of an unverified downloaded binary. That is concrete install-hook abuse under the stated policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, through postinstall.

Impact

An install can alter SokeClaw, Zev, and WorkClaw agent behavior and run an unverified downloaded binary.

Mechanism

Install-time executable download and broad AI-agent skill registration.

Policy narrative

The postinstall hook runs automatically. It downloads a release binary, grants it execute permission, copies packaged skill directories into SokeClaw and Zev workspaces, and registers those skills as enabled in WorkClaw. These are behavior-bearing AI-agent control surfaces outside the installed package, and the installer does not ask for consent before mutating them.

AI rationale

Evidence

package.jsonscripts/install.jsbin/soke-cli$HOME/.sokeclaw/openai-agents/workspaces/main/skills$HOME/.zev/openai-agents/workspaces/main/skills$HOME/.workclaw/skills$HOME/.workclaw/skills/registry.json

Network endpoints1

github.com/sokeai/soke-cli/releases/download/v${version}/${binaryFileName}

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the installer.
The installer downloads an executable from GitHub Releases and makes it executable without a checksum or signature check.
During installation it copies bundled skills into SokeClaw and Zev agent workspace directories.
It writes enabled skill records into the existing WorkClaw registry without user confirmation.

Evidence against

The only hard-coded download endpoint is the package's GitHub repository releases URL.
No source evidence shows credential collection or secret exfiltration.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 38.2 KB of source, external domains: github.com

Source & flagged code

13 flagged

package.jsonView file

Lines 1-29json

2 "name": "@sokeai/cli",

3 "version": "1.0.79",

4 "description": "授客AI官方CLI工具 - 支持AI Agent Skills",

5 "bin": {

6 "soke-cli": "scripts/run.js"

7 },

8 "scripts": {

9 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "build": "./scripts/build-binaries.sh",

11 "release": "./scripts/release.sh"

12 },

13 "files": [

14 "scripts/",

15 "skills/"

16 ],

17 "homepage": "https://github.com/sokeai/soke-cli#readme",

18 "repository": {

19 "type": "git",

20 "url": "https://github.com/sokeai/soke-cli.git"

21 },

22 "keywords": [

23 "soke",

24 "cli",

25 "授客AI",

26 "shouke",

27 "command-line",

28 "ai-agent",

29 "skills",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

scripts/run.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

scripts/install.jsView file

Lines 1-33javascript

1const os = require('os');

2const path = require('path');

3const fs = require

scripts/local-test.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: !== after) { fs.writefilesync(target.registrypath, json.stringify(registry, null, 2)); logsuccess(` ✓ 清理 registry.json (删除 ${before - after} 个条目)`); } } } catch (err) { logerror(` ✗ 清理 registry.json 失败: ${err.message}`); } } console.log(''); } } /** * 主函数 */ function main() { const args = process.argv.slice(2); const isclean = args.includes('--clean'); const skillarg = args.find(arg => arg.startswith('--skill=')); const specificskill = skillarg ? sk[redacted]('=')[1] : null; logsection('本地 skill 测试工具'); // 检测项目目录 const packageroot = path.join(__dirname, '..'); const packagedskillsdir = path.join(packageroo

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/local-test.jsView on unpkg

scripts/push.shView file

•path = scripts/push.sh kind = build_helper sizeBytes = 6312 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/push.shView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.jsView file

Findings

2 Critical10 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/install.js

CriticalPrevious Version Dangerous Deltascripts/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/run.js

HighShell

HighInstall Named Payload Filescripts/install.js

HighExternal Ai Agent Control Surface Mutationscripts/local-test.js

HighRuntime Package Installscripts/install.js

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similarityscripts/install.js

HighKnown Malware Source Similarityscripts/run.js

HighKnown Malware Source Fingerprint Signature

Affected versions and remediation

This report applies to @sokeai/cli@1.0.79.

The versions list below shows the verdict for each recorded version.

Avoid installing @sokeai/cli@1.0.79. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-01 09:25:48.851Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

34 known versions

1.0.116latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 12:26 PM 1.0.115SuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 11:46 AM 1.0.114SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 3:26 AM 1.0.113SuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 2:49 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code