Loading npm security reports…

@wowok/skills@2.2.2: AI-agent control-surface risk | LPM Firewall

registry / @wowok/skills / 2.2.2

@wowok/skills@2.2.2

WoWok AI Skills for Claude and other AI assistants - Dialogue orchestration layer on top of the WoWok MCP server (rules/reference knowledge is served by MCP directly since v2.0.0)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm postinstall, the package writes skills and MCP configuration across AI clients by default. It globally installs and registers a separately resolved MCP package, enabling it to run through those clients.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall of @wowok/skills@2.2.2 without WOWOK_SKILLS_NO_MCP set

Impact

Persistent execution path for @wowok/agent-mcp is added to multiple AI-agent control surfaces, including Codex.

Mechanism

broad AI-client config mutation plus global npm MCP installation

Policy narrative

Installing the package triggers scripts/install.js. Unless an opt-out variable is set, it targets all supported AI clients, installs or upgrades @wowok/agent-mcp globally, writes MCP configuration entries that run it through npx, and may terminate an existing MCP process for restart. This is unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The lifecycle hook performs broad AI-client configuration and executable MCP registration by default, rather than limiting setup to an explicit user command or a package-owned surface. No source evidence offsets this install-time control-surface behavior.

Evidence

package.jsonscripts/install.jsdist/cli.js~/.claude/settings.json~/.codex/config.toml~/.codeium/windsurf/mcp_config.json~/.copilot/mcp-config.json~/.roo/mcp_settings.json

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

38const path = __importStar(require("path")); L39: const child_process_1 = require("child_process"); L40: const os = __importStar(require("os"));

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L38

455try { L456: (0, child_process_1.execSync)(`npm install -g ${pkg}`, { stdio: 'inherit', timeout: 120000 }); L457: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L455

•matchType = normalized_sha256 matchedPackage = @wowok/skills@2.2.1 matchedPath = dist/cli.js matchedIdentity = npm:QHdvd29rL3NraWxscw:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = ec7b8aa5b8230d70 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wowok/skills@2.2.1 matchedPath = dist/cli.js matchedIdentity = npm:QHdvd29rL3NraWxscw:2.2.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

scripts/install.jsView file

66const CLIENT_DIRS = { L67: claude: path.join(os.homedir(), '.claude', 'skills'), L68: cursor: path.join(os.homedir(), '.cursor', 'rules'), ... L70: codebuddy: path.join(os.homedir(), '.codebuddy', 'skills'), L71: codex: path.join(os.homedir(), '.codex', 'skills'), L72: trae: path.join(os.homedir(), '.agents', 'skills'), L73: qoder: path.join(os.homedir(), '.qoder', 'skills'), ... L76: kilo: path.join(os.homedir(), '.kilo', 'skills'), L77: agents: path.join(os.homedir(), '.agents', 'skills'), // deprecated alias L78: copilot: path.join(os.homedir(), '.github', 'prompts'), ... L120: const dir = wowMcpDir(); L121: fs.mkdirSync(dir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L66

844if (process.platform === 'win32') { L845: // Windows: use PowerShell (via -EncodedCommand to avoid quoting hell) L846: const psScript =

High

Shell

Package source references shell execution.

scripts/install.jsView on unpkg · L844

•matchType = normalized_sha256 matchedPackage = @wowok/skills@2.2.1 matchedPath = scripts/install.js matchedIdentity = npm:QHdvd29rL3NraWxscw:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.js