Loading npm security reports…

@wowok/skills@3.0.4: AI-agent control-surface risk | LPM Firewall

registry / @wowok/skills / 3.0.4

@wowok/skills@3.0.4

WoWok AI Skills for Claude and other AI assistants - Dialogue orchestration layer on top of the WoWok MCP server (rules/reference knowledge is served by MCP directly since v2.0.0)

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently writes skills and MCP registrations across broad user-level AI-agent directories. It configures those clients to launch a separately installed MCP package through npx and may restart its process.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

A dependency installation changes multiple AI-agent control surfaces and causes them to run @wowok/agent-mcp.

Mechanism

Automatic broad AI-agent configuration mutation and global MCP installation

Policy narrative

On npm installation, postinstall runs scripts/install.js without an explicit user command. By default it copies package skills into eleven AI-client directories, installs or upgrades @wowok/agent-mcp globally, and modifies client MCP configuration to invoke it with npx. This includes the Codex global configuration. If the MCP package changes, it terminates matching processes so the IDE restarts them. This is unconsented, broad mutation of foreign AI-agent control surfaces at install time.

AI rationale

The package performs automatic postinstall mutation of numerous third-party AI-agent configurations and installs a separate executable MCP dependency. This is a concrete install-hook abuse chain under the stated policy.

Evidence

package.jsonscripts/install.js~/.claude/skills~/.cursor/rules~/.windsurf/skills~/.codebuddy/skills~/.codex/skills~/.agents/skills~/.qoder/skills

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

38const path = __importStar(require("path")); L39: const child_process_1 = require("child_process"); L40: const os = __importStar(require("os"));

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L38

456try { L457: (0, child_process_1.execSync)(`npm install -g ${pkg}`, { stdio: 'inherit', timeout: 120000 }); L458: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L456

•matchType = normalized_sha256 matchedPackage = @wowok/skills@3.0.3 matchedPath = dist/cli.js matchedIdentity = npm:QHdvd29rL3NraWxscw:3.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

scripts/install.jsView file

67const CLIENT_DIRS = { L68: claude: path.join(os.homedir(), '.claude', 'skills'), L69: cursor: path.join(os.homedir(), '.cursor', 'rules'), ... L71: codebuddy: path.join(os.homedir(), '.codebuddy', 'skills'), L72: codex: path.join(os.homedir(), '.codex', 'skills'), L73: trae: path.join(os.homedir(), '.agents', 'skills'), L74: qoder: path.join(os.homedir(), '.qoder', 'skills'), ... L77: kilo: path.join(os.homedir(), '.kilo', 'skills'), L78: agents: path.join(os.homedir(), '.agents', 'skills'), // deprecated alias L79: copilot: path.join(os.homedir(), '.github', 'prompts'), ... L121: const dir = wowMcpDir(); L122: fs.mkdirSync(dir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L67

845if (process.platform === 'win32') { L846: // Windows: use PowerShell (via -EncodedCommand to avoid quoting hell) L847: const psScript =

High

Shell

Package source references shell execution.

scripts/install.jsView on unpkg · L845

•matchType = token_shingles matchedPackage = @wowok/skills@3.0.3 matchedPath = scripts/install.js matchedIdentity = npm:QHdvd29rL3NraWxscw:3.0.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.js

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 14-54json

14 "wowok-collaborator/",

15 "wowok-arbitrator/",

16 "wowok-machine/",

17 "wowok-order/",

18 "wowok-messenger/",

19 "wowok-output/",

20 "wowok-onboard/",

21 "wowok-planner/",

22 "wowok-auditor/",

23 "wowok-governance/",

24 "wowok-market/",

25 "examples/",

26 "scripts/install.js",

27 "README.md",

28 "LICENSE"

29 ],

30 "scripts": {

31 "build": "tsc",

32 "watch": "tsc --watch",

33 "prepublishOnly": "npm run build",

34 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 "preuninstall": "node scripts/install.js"

36 },

37 "keywords": [

38 "wowok",

39 "ai",

40 "skills",

41 "claude",

42 "mcp",

43 "blockchain",

44 "web3",

45 "ai-agent"

46 ],

47 "author": "wowok <build@wowok.net>",

48 "license": "MIT",

49 "repository": {

50 "type": "git",

51 "url": "https://github.com/wowok-ai/skills.git"

52 },

53 "homepage": "https://wowok.net",

54 "devDependencies": {

dist/cli.jsView file

Lines 18-58javascript

18});

19var __importStar = (this && this.__importStar) || (function () {

20 var ownKeys = function(o) {

scripts/install.jsView file

Lines 47-87javascript

47/**

48 * Deprecated skills removed in the GLM5-31 sink refactor. They are NEVER

49 * installed, but preuninstall/init still clean them up from legacy installs

50 * and warn the user where the content now lives.

51 */

52const LEGACY_SKILL_DIRS = [

53 'wowok-guard',

54 'wowok-tools'

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg