Loading npm security reports…

@wowok/skills@3.2.3: AI-agent control-surface risk | LPM Firewall

registry / @wowok/skills / 3.2.3

@wowok/skills@3.2.3

WoWok AI Skills for Claude Code, Codex, Gemini CLI, Qwen Code, Grok Build, OpenCode, Google Antigravity, Cursor, Devin Desktop (formerly Windsurf), Trae, CodeBuddy, WorkBuddy, Qoder, Cline, Kilo Code and GitHub Copilot - dialogue orchestration layer on to

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes user-scope AI-client skill directories and MCP control configuration. It also installs and registers a separate global MCP package unless the installer environment opt-out is supplied.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm automatically runs the package postinstall hook.

Impact

A dependency installation can alter multiple AI-agent control surfaces and cause an additional MCP program to be installed and configured without an explicit setup command.

Mechanism

The hook invokes the shared installer, selects all supported targets by default, writes skills, runs a global npm install, and adds MCP launch entries to client configuration files.

Policy narrative

A normal npm install triggers scripts/install.js, which calls the lifecycle installer. That installer defaults to every supported AI-client target, writes user-scope skills, installs @wowok/agent-mcp globally, and registers MCP launch entries in client configuration files. The behavior is automatic rather than an explicit user setup command.

AI rationale

The automatic postinstall hook performs broad, foreign AI-agent configuration mutation and installs an additional global package. This is a concrete install-time control-surface attack under the launcher isolation policy.

Evidence

package.jsonscripts/install.jsdist/installer.jsdist/targets.js~/.claude.json~/.codex/config.toml

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/installer.jsView file

137}; L138: fs.writeFileSync(path.join(root, targets_1.MANIFEST_FILE), JSON.stringify(manifest, null, 2) + '\n', 'utf-8'); L139: } ... L150: try { L151: fs.mkdirSync(root, { recursive: true }); L152: } ... L183: } L184: fs.mkdirSync(destDir, { recursive: true }); L185: fs.writeFileSync(dest, content, 'utf-8'); L186: result.written++; ... L237: * cursor `.mdc` rules, `.prompt.md` files, and skills placed in directories the L238: * client never reads (`~/.codex/skills`, `~/.windsurf/skills`, …).

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L137

71const path = __importStar(require("path")); L72: const child_process_1 = require("child_process"); L73: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/installer.jsView on unpkg · L71

701const encoded = Buffer.from(ps, 'utf16le').toString('base64'); L702: (0, child_process_1.execSync)(`powershell -NoProfile -EncodedCommand ${encoded}`, { stdio: 'pipe', timeout: 15000 }); L703: }

High

Shell

Package source references shell execution.

dist/installer.jsView on unpkg · L701

634try { L635: (0, child_process_1.execSync)(`npm install -g ${pkg}`, { stdio: 'inherit', timeout: 180000 }); L636: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer.jsView on unpkg · L634

71const path = __importStar(require("path")); L72: const child_process_1 = require("child_process"); L73: const crypto = __importStar(require("crypto")); ... L78: function packageRoot() { L79: return path.resolve(__dirname, '..'); L80: } ... L82: try { L83: const raw = fs.readFileSync(path.join(packageRoot(), 'package.json'), 'utf-8'); L84: return JSON.parse(raw).version || '0.0.0'; L85: } ... L376: return { command: 'node', args: [entry] }; L377: if (process.platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/installer.jsView on unpkg · L71

dist/skills.jsView file

45exports.checkSkillMigration = checkSkillMigration; L46: const fs = __importStar(require("fs")); L47: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/skills.jsView on unpkg · L45

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 13-53json

13 "wowok-supplier/",

14 "wowok-collaborator/",

15 "wowok-arbitrator/",

16 "wowok-machine/",

17 "wowok-order/",

18 "wowok-messenger/",

19 "wowok-output/",

20 "wowok-onboard/",

21 "wowok-planner/",

22 "wowok-auditor/",

23 "wowok-governance/",

24 "wowok-market/",

25 "scripts/install.js",

26 "README.md",

27 "LICENSE"

28 ],

29 "scripts": {

30 "build": "tsc",

31 "watch": "tsc --watch",

32 "prepublishOnly": "npm run build",

33 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "audit:skills": "node scripts/validate-skills.mjs",

35 "audit:length": "node scripts/check-skills-length.mjs",

36 "audit:drift": "node scripts/check-skill-mcp-drift.mjs",

37 "check": "npm run build && npm run audit:skills && npm run audit:length && npm run audit:drift"

38 },

39 "keywords": [

40 "wowok",

41 "ai",

42 "skills",

43 "claude",

44 "mcp",

45 "blockchain",

46 "web3",

47 "ai-agent"

48 ],

49 "author": "wowok <build@wowok.net>",

50 "license": "MIT",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/wowok-ai/skills.git"

dist/installer.jsView file

Lines 51-91javascript

51exports.installSkillsInto = installSkillsInto;

52exports.uninstallSkillsFrom = uninstallSkillsFrom;

53exports.cleanupLegacyArtifacts = cleanupLegacyArtifacts;

54exports.installSkillsForTargets = installSkillsForTargets;

55exports.uninstallSkillsForTargets = uninstallSkillsForTargets;

dist/skills.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Lines 681-721javascript

681 }

682 console.error(' installation failed.');

683 return false;

684}

685/**

686 * Kill the running MCP server process so clients relaunch it with the new code.

687 * Matches ONLY our launcher (`node <entry>` / the npx cache invocation) so an

688 * unrelated node process is never touched.

689 */

690function restartMcpServer() {

691 try {

692 if (process.platform === 'win32') {

693 const entry = resolveInstalledMcpEntry();

694 const patterns = [`'%${targets_1.MCP_PACKAGE}%'`, `'%agent-mcp%'`];

695 const entryClause = entry

696 ? `OR (${patterns.map((p) => `CommandLine LIKE ${p}`).join(' OR ')})`

697 : '';

698 const ps = 'Get-CimInstance Win32_Process -Filter "Name=\'node.exe\'" | ' +

699 `Where-Object { $_.CommandLine -like '*agent-mcp*' ${entryClause} } | ` +

700 'ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }';

701 const encoded = Buffer.from(ps, 'utf16le').toString('base64');

702 (0, child_process_1.execSync)(`powershell -NoProfile -EncodedCommand ${encoded}`, { stdio: 'pipe', timeout: 15000 });

703 }

High

Shell

Package source references shell execution.

dist/installer.jsView on unpkg · L701

704 else {

705 (0, child_process_1.execSync)(`pkill -f "node_modules/${targets_1.MCP_PACKAGE}/" || pkill -f "npx.*${targets_1.MCP_PACKAGE}" || true`, {

706 stdio: 'pipe',

707 timeout: 8000,

708 });

709 }

710 console.log('[wowok-skills] MCP server process terminated (clients auto-restart it).');

711 }

712 catch {

713 console.log('[wowok-skills] No running MCP server process found.');

714 }

715}

716// =========================================================================

717// Airdrop referrer

718// =========================================================================

719/** Wow MCP data dir — mirrors @wowok/wowok getWowMcpDir(). */

720function wowMcpDir() {

721 const h = os.homedir();