Loading npm security reports…

@wowok/skills@3.2.4: AI-agent control-surface risk | LPM Firewall

registry / @wowok/skills / 3.2.4

@wowok/skills@3.2.4

WoWok AI Skills for Claude Code, Codex, Gemini CLI, Qwen Code, Grok Build, OpenCode, Google Antigravity, Cursor, Devin Desktop (formerly Windsurf), Trae, CodeBuddy, WorkBuddy, Qoder, Cline, Kilo Code and GitHub Copilot - dialogue orchestration layer on to

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation changes AI-client skill and MCP configuration. It also installs and launches a separate MCP package.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Installing this dependency can alter broad AI-agent control surfaces without an explicit user command.

Mechanism

The lifecycle handler writes user-target skills, globally installs @wowok/agent-mcp, and registers its launcher in client MCP configuration.

Policy narrative

The package's postinstall hook automatically invokes an installer. That installer targets user AI-client locations, installs a separate MCP package globally, and registers the MCP launcher in client configuration files, including Codex configuration. This is an unconsented install-time mutation of broad AI-agent control surfaces.

AI rationale

The automatic lifecycle chain performs broad AI-agent configuration mutation and installs an additional executable MCP dependency. This meets the install-control-surface blocking rule.

Evidence

package.jsonscripts/install.jsdist/installer.jsdist/targets.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with false-positive risk.

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/installer.jsView file

137}; L138: fs.writeFileSync(path.join(root, targets_1.MANIFEST_FILE), JSON.stringify(manifest, null, 2) + '\n', 'utf-8'); L139: } ... L150: try { L151: fs.mkdirSync(root, { recursive: true }); L152: } ... L183: } L184: fs.mkdirSync(destDir, { recursive: true }); L185: fs.writeFileSync(dest, content, 'utf-8'); L186: result.written++; ... L237: * cursor `.mdc` rules, `.prompt.md` files, and skills placed in directories the L238: * client never reads (`~/.codex/skills`, `~/.windsurf/skills`, …).

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L137

71const path = __importStar(require("path")); L72: const child_process_1 = require("child_process"); L73: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/installer.jsView on unpkg · L71

701const encoded = Buffer.from(ps, 'utf16le').toString('base64'); L702: (0, child_process_1.execSync)(`powershell -NoProfile -EncodedCommand ${encoded}`, { stdio: 'pipe', timeout: 15000 }); L703: }

High

Shell

Package source references shell execution.

dist/installer.jsView on unpkg · L701

634try { L635: (0, child_process_1.execSync)(`npm install -g ${pkg}`, { stdio: 'inherit', timeout: 180000 }); L636: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer.jsView on unpkg · L634

•matchType = malicious_source_fingerprint_signature signature = 959f7ab7515419a1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wowok/skills@3.2.3 matchedPath = dist/installer.js matchedIdentity = npm:QHdvd29rL3NraWxscw:3.2.3 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/installer.jsView on unpkg

71const path = __importStar(require("path")); L72: const child_process_1 = require("child_process"); L73: const crypto = __importStar(require("crypto")); ... L78: function packageRoot() { L79: return path.resolve(__dirname, '..'); L80: } ... L82: try { L83: const raw = fs.readFileSync(path.join(packageRoot(), 'package.json'), 'utf-8'); L84: return JSON.parse(raw).version || '0.0.0'; L85: } ... L376: return { command: 'node', args: [entry] }; L377: if (process.platform === 'win32') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/installer.jsView on unpkg · L71

dist/skills.jsView file

45exports.checkSkillMigration = checkSkillMigration; L46: const fs = __importStar(require("fs")); L47: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/skills.jsView on unpkg · L45

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 13-53json

13 "wowok-supplier/",

14 "wowok-collaborator/",

15 "wowok-arbitrator/",

16 "wowok-machine/",

17 "wowok-order/",

18 "wowok-messenger/",

19 "wowok-output/",

20 "wowok-onboard/",

21 "wowok-planner/",

22 "wowok-auditor/",

23 "wowok-governance/",

24 "wowok-market/",

25 "scripts/install.js",

26 "README.md",

27 "LICENSE"

28 ],

29 "scripts": {

30 "build": "tsc",

31 "watch": "tsc --watch",

32 "prepublishOnly": "npm run build",

33 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "audit:skills": "node scripts/validate-skills.mjs",

35 "audit:length": "node scripts/check-skills-length.mjs",

36 "audit:drift": "node scripts/check-skill-mcp-drift.mjs",

37 "check": "npm run build && npm run audit:skills && npm run audit:length && npm run audit:drift"

38 },

39 "keywords": [

40 "wowok",

41 "ai",

42 "skills",

43 "claude",

44 "mcp",

45 "blockchain",

46 "web3",

47 "ai-agent"

48 ],

49 "author": "wowok <build@wowok.net>",

50 "license": "MIT",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/wowok-ai/skills.git"

dist/installer.jsView file

Lines 51-91javascript

51exports.installSkillsInto = installSkillsInto;

52exports.uninstallSkillsFrom = uninstallSkillsFrom;

53exports.cleanupLegacyArtifacts = cleanupLegacyArtifacts;

54exports.installSkillsForTargets = installSkillsForTargets;

55exports.uninstallSkillsForTargets = uninstallSkillsForTargets;

dist/skills.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

dist/cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.js#virtual:normalized:round1View on unpkg

Lines 681-721javascript

681 }

682 console.error(' installation failed.');

683 return false;

684}

685/**

686 * Kill the running MCP server process so clients relaunch it with the new code.

687 * Matches ONLY our launcher (`node <entry>` / the npx cache invocation) so an

688 * unrelated node process is never touched.

689 */

690function restartMcpServer() {

691 try {

692 if (process.platform === 'win32') {

693 const entry = resolveInstalledMcpEntry();

694 const patterns = [`'%${targets_1.MCP_PACKAGE}%'`, `'%agent-mcp%'`];

695 const entryClause = entry

696 ? `OR (${patterns.map((p) => `CommandLine LIKE ${p}`).join(' OR ')})`

697 : '';

698 const ps = 'Get-CimInstance Win32_Process -Filter "Name=\'node.exe\'" | ' +

699 `Where-Object { $_.CommandLine -like '*agent-mcp*' ${entryClause} } | ` +

700 'ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }';

701 const encoded = Buffer.from(ps, 'utf16le').toString('base64');

702 (0, child_process_1.execSync)(`powershell -NoProfile -EncodedCommand ${encoded}`, { stdio: 'pipe', timeout: 15000 });

703 }

High

Shell

Package source references shell execution.

dist/installer.jsView on unpkg · L701

704 else {

705 (0, child_process_1.execSync)(`pkill -f "node_modules/${targets_1.MCP_PACKAGE}/" || pkill -f "npx.*${targets_1.MCP_PACKAGE}" || true`, {

706 stdio: 'pipe',

707 timeout: 8000,

708 });

709 }

710 console.log('[wowok-skills] MCP server process terminated (clients auto-restart it).');

711 }

712 catch {

713 console.log('[wowok-skills] No running MCP server process found.');

714 }

715}

716// =========================================================================

717// Airdrop referrer

718// =========================================================================

719/** Wow MCP data dir — mirrors @wowok/wowok getWowMcpDir(). */

720function wowMcpDir() {

721 const h = os.homedir();