@wowok/skills@3.3.0
WoWok AI Skills for Claude Code, Codex, Gemini CLI, Qwen Code, Grok Build, OpenCode, Google Antigravity, Cursor, Devin Desktop (formerly Windsurf), Trae, CodeBuddy, WorkBuddy, Qoder, Cline, Kilo Code and GitHub Copilot - dialogue orchestration layer on to
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe npm postinstall automatically mutates user-level configuration for multiple AI clients and registers an MCP server by default. This meets the policy for blocking unconsented install-time changes to a broad AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package through npm, which invokes postinstall.
Impact
Installation changes AI client behavior and enables the registered WoWok MCP server for affected clients.
Mechanism
The lifecycle handler installs skill files for resolved user targets and, unless opted out, ensures an MCP server and registers it in client configuration files.
Policy narrative
The package’s automatic postinstall writes skills and MCP server registration into user-level AI client configurations. The registration is on by default; an environment variable can disable MCP management. This is an unconsented install-time change to AI-agent control surfaces.
AI rationale
The npm postinstall automatically mutates user-level configuration for multiple AI clients and registers an MCP server by default. This meets the policy for blocking unconsented install-time changes to a broad AI-agent control surface.
Evidence
package.jsonscripts/install.jsdist/installer.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs scripts/install.js from postinstall.
- The postinstall handler installs skills for automatically resolved user targets.
- Unless an environment variable disables it, postinstall checks and registers an MCP server in client configuration files.
- The installer writes an MCP server command and arguments into client configuration.
Evidence against
- The installer’s MCP registration has an opt-out environment variable, but registration is enabled by default.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/installer.jsView file
137};
L138: fs.writeFileSync(path.join(root, targets_1.MANIFEST_FILE), JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
L139: }
...
L150: try {
L151: fs.mkdirSync(root, { recursive: true });
L152: }
...
L183: }
L184: fs.mkdirSync(destDir, { recursive: true });
L185: fs.writeFileSync(dest, content, 'utf-8');
L186: result.written++;
...
L237: * cursor `.mdc` rules, `.prompt.md` files, and skills placed in directories the
L238: * client never reads (`~/.codex/skills`, `~/.windsurf/skills`, …).
Critical
Findings
1 Critical6 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/installer.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/installer.js
HighShelldist/installer.js
HighRuntime Package Installdist/installer.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
HighKnown Malware Source Fingerprint Signaturedist/installer.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/skills.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @wowok/skills@3.3.0.
See all versions of @wowok/skills for other recorded verdicts.
- Avoid installing @wowok/skills@3.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.