Loading npm security reports…

@wowok/skills@3.2.2: AI-agent control-surface risk | LPM Firewall

registry / @wowok/skills / 3.2.2

@wowok/skills@3.2.2

WoWok AI Skills for Claude Code, Codex, Gemini CLI, Qwen Code, Grok Build, OpenCode, Google Antigravity, Cursor, Devin Desktop (formerly Windsurf), Trae, CodeBuddy, WorkBuddy, Qoder, Cline, Kilo Code and GitHub Copilot - dialogue orchestration layer on to

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall automatically modifies user-level AI-agent skill and MCP control surfaces across client targets. No explicit user command is required.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through npm triggers postinstall.

Impact

Installation can cause Codex and other AI clients to load package-provided skills and a registered MCP server in their user configuration.

Mechanism

The launcher calls the lifecycle handler, which resolves all targets, writes user-scope skills, installs or manages an MCP server, and registers it in client configuration files unless a pre-set environment opt-out is present.

Policy narrative

The package manifest automatically launches an installer on npm postinstall. That installer selects all supported clients by default, writes skills into user-controlled agent directories, and registers an MCP server in client configuration files. Codex is explicitly among the targets, including its user skill directories and MCP configuration. The environment opt-out requires prior user knowledge and does not make the default lifecycle behavior consented.

AI rationale

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. It meets the install-control-surface blocking policy even though no secret exfiltration was found.

Evidence

package.jsonscripts/install.jsdist/installer.jsdist/targets.js

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/installer.jsView file

137}; L138: fs.writeFileSync(path.join(root, targets_1.MANIFEST_FILE), JSON.stringify(manifest, null, 2) + '\n', 'utf-8'); L139: } ... L150: try { L151: fs.mkdirSync(root, { recursive: true }); L152: } ... L183: } L184: fs.mkdirSync(destDir, { recursive: true }); L185: fs.writeFileSync(dest, content, 'utf-8'); L186: result.written++; ... L237: * cursor `.mdc` rules, `.prompt.md` files, and skills placed in directories the L238: * client never reads (`~/.codex/skills`, `~/.windsurf/skills`, …).

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L137

71const path = __importStar(require("path")); L72: const child_process_1 = require("child_process"); L73: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/installer.jsView on unpkg · L71

654const encoded = Buffer.from(ps, 'utf16le').toString('base64'); L655: (0, child_process_1.execSync)(`powershell -NoProfile -EncodedCommand ${encoded}`, { stdio: 'pipe', timeout: 15000 }); L656: }

High

Shell

Package source references shell execution.

dist/installer.jsView on unpkg · L654

587try { L588: (0, child_process_1.execSync)(`npm install -g ${pkg}`, { stdio: 'inherit', timeout: 180000 }); L589: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer.jsView on unpkg · L587

71const path = __importStar(require("path")); L72: const child_process_1 = require("child_process"); L73: const crypto = __importStar(require("crypto")); ... L78: function packageRoot() { L79: return path.resolve(__dirname, '..'); L80: } ... L82: try { L83: const raw = fs.readFileSync(path.join(packageRoot(), 'package.json'), 'utf-8'); L84: return JSON.parse(raw).version || '0.0.0'; L85: } ... L376: return { command: 'node', args: [entry] }; L377: if (process.platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/installer.jsView on unpkg · L71

dist/skills.jsView file

45exports.checkSkillMigration = checkSkillMigration; L46: const fs = __importStar(require("fs")); L47: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/skills.jsView on unpkg · L45

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 13-53json

13 "wowok-supplier/",

14 "wowok-collaborator/",

15 "wowok-arbitrator/",

16 "wowok-machine/",

17 "wowok-order/",

18 "wowok-messenger/",

19 "wowok-output/",

20 "wowok-onboard/",

21 "wowok-planner/",

22 "wowok-auditor/",

23 "wowok-governance/",

24 "wowok-market/",

25 "scripts/install.js",

26 "README.md",

27 "LICENSE"

28 ],

29 "scripts": {

30 "build": "tsc",

31 "watch": "tsc --watch",

32 "prepublishOnly": "npm run build",

33 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "audit:skills": "node scripts/validate-skills.mjs",

35 "audit:length": "node scripts/check-skills-length.mjs",

36 "audit:drift": "node scripts/check-skill-mcp-drift.mjs",

37 "check": "npm run build && npm run audit:skills && npm run audit:length && npm run audit:drift"

38 },

39 "keywords": [

40 "wowok",

41 "ai",

42 "skills",

43 "claude",

44 "mcp",

45 "blockchain",

46 "web3",

47 "ai-agent"

48 ],

49 "author": "wowok <build@wowok.net>",

50 "license": "MIT",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/wowok-ai/skills.git"

dist/installer.jsView file

Lines 51-91javascript

51exports.installSkillsInto = installSkillsInto;

52exports.uninstallSkillsFrom = uninstallSkillsFrom;

53exports.cleanupLegacyArtifacts = cleanupLegacyArtifacts;

54exports.installSkillsForTargets = installSkillsForTargets;

55exports.uninstallSkillsForTargets = uninstallSkillsForTargets;

dist/skills.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Lines 634-674javascript

634 }

635 console.error(' installation failed.');

636 return false;

637}

638/**

639 * Kill the running MCP server process so clients relaunch it with the new code.

640 * Matches ONLY our launcher (`node <entry>` / the npx cache invocation) so an

641 * unrelated node process is never touched.

642 */

643function restartMcpServer() {

644 try {

645 if (process.platform === 'win32') {

646 const entry = resolveInstalledMcpEntry();

647 const patterns = [`'%${targets_1.MCP_PACKAGE}%'`, `'%agent-mcp%'`];

648 const entryClause = entry

649 ? `OR (${patterns.map((p) => `CommandLine LIKE ${p}`).join(' OR ')})`

650 : '';

651 const ps = 'Get-CimInstance Win32_Process -Filter "Name=\'node.exe\'" | ' +

652 `Where-Object { $_.CommandLine -like '*agent-mcp*' ${entryClause} } | ` +

653 'ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }';

654 const encoded = Buffer.from(ps, 'utf16le').toString('base64');

655 (0, child_process_1.execSync)(`powershell -NoProfile -EncodedCommand ${encoded}`, { stdio: 'pipe', timeout: 15000 });

656 }

High

Shell

Package source references shell execution.

dist/installer.jsView on unpkg · L654

657 else {

658 (0, child_process_1.execSync)(`pkill -f "node_modules/${targets_1.MCP_PACKAGE}/" || pkill -f "npx.*${targets_1.MCP_PACKAGE}" || true`, {

659 stdio: 'pipe',

660 timeout: 8000,

661 });

662 }

663 console.log('[wowok-skills] MCP server process terminated (clients auto-restart it).');

664 }

665 catch {

666 console.log('[wowok-skills] No running MCP server process found.');

667 }

668}

669// =========================================================================

670// Airdrop referrer

671// =========================================================================

672/** Wow MCP data dir — mirrors @wowok/wowok getWowMcpDir(). */

673function wowMcpDir() {

674 const h = os.homedir();