@yunkeai/yunke-cli@2.0.6
AI-native pluggable CLI framework
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe install hook automatically distributes downloaded skills into broad AI client extension locations without a consent gate. This meets the package’s install-time agent control-surface mutation block criterion.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the npm package triggers its postinstall script.
Impact
Downloaded skill content becomes available to multiple AI clients and can affect their behavior.
Mechanism
The script invokes the bundled skill installer for a fixed skill list; the installer distributes skills to detected client directories and has a default multi-client mode.
Policy narrative
During npm installation, the package automatically runs a script that installs a fixed set of skills through the bundled downloader. The installer targets detected AI client skill directories across multiple clients, creating an unconsented agent control surface.
AI rationale
The install hook automatically distributes downloaded skills into broad AI client extension locations without a consent gate. This meets the package’s install-time agent control-surface mutation block criterion.
Evidence
package.jsonscripts/postinstall.cjsdist/bundle.js~/.yunke/skillshub.jsondetected AI client skill directories
Network endpoints1
skillshub.yunke.ai
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.cjs automatically after installation.
- The postinstall script invokes skill installation for a fixed list of skills without a user command.
- The installer targets detected AI client skill directories, including Claude, WorkBuddy, and other clients.
- The bundle describes skill installation as distributing to all detected clients, with a single-directory option as an escape hatch.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/bundle.jsView file
11`:`[${Q[W]}\r
L12: ]`;continue}if(X+=Q[W],Q[W]==="\\")J=!0;else if(w&&Q[W]==="]")w=!1;else if(!w&&Q[W]==="[")w=!0}try{new RegExp(X)}catch{return console.warn(`Could not convert regex pattern at ${q.c...
L13: ${x.join(`
High
Findings
1 Critical10 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/bundle.js
HighShellscripts/postinstall.cjs
HighSame File Env Network Executiondist/bundle.js
HighCommand Output Exfiltrationdist/bundle.js
HighCross File Remote Execution Contextscripts/postinstall.cjs
HighTrigger Reachable Command Output Exfiltrationdist/bundle.js
HighKnown Malware Source Similaritydist/bundle.js
HighKnown Malware Source Similarityscripts/postinstall.cjs
HighKnown Malware Source Fingerprint Signaturedist/bundle.js
Affected versions and remediation
This report applies to @yunkeai/yunke-cli@2.0.6.
See all versions of @yunkeai/yunke-cli for other recorded verdicts.
- Avoid installing @yunkeai/yunke-cli@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.