registry / AI-agent control-surface risk / @yunzhijia/cli
@yunzhijia/cli
Yunzhijia (云之家) CLI — manage contacts, documents, calendar events and meeting rooms from the terminal or AI Agent
This report shows the evidence for @yunzhijia/cli@0.1.7. 4 of 5 known versions are blocked or flagged. The newest version, 0.1.8, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe postinstall hook establishes or replaces skills across unrelated AI-agent products without an explicit user setup action. This meets the install-time foreign/broad AI-agent control-surface mutation block policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall runs when the package is installed.
Impact
A package installation can establish or replace instructions used by several AI-agent tools without an explicit setup command.
Mechanism
Postinstall downloads a binary and forcibly replaces agent skill directories.
Policy narrative
A registry installation invokes scripts/install.js. The script downloads an archive containing an executable, installs it, and runs it for a version check. It then removes and copies a package-provided skill into up to ten AI-agent configuration locations under the user's home directory, including a fallback location it creates. This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces.
AI rationale
The postinstall hook establishes or replaces skills across unrelated AI-agent products without an explicit user setup action. This meets the install-time foreign/broad AI-agent control-surface mutation block policy.
Evidence
package.jsonscripts/install.jsbin/yzj-cli~/.agents/skills/yzj-cli~/.claude/skills/yzj-cli~/.cursor/skills/yzj-cli~/.gemini/skills/yzj-cli~/.codex/skills/yzj-cli~/.github/skills/yzj-cli~/.windsurf/skills/yzj-cli~/.cline/skills/yzj-cli~/.trae/skills/yzj-cli~/.hermes/skills/yzj-cli
Network endpoints1
www.yunzhijia.com/mixed/yzj-cli
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs scripts/install.js automatically through postinstall.
- The installer targets ten AI-agent skill locations under the user's home directory.
- During installation it forcibly deletes and replaces a skill directory in each detected agent location, and creates a fallback .agents directory.
- The lifecycle script downloads, extracts, installs, and executes a remote binary.
Evidence against
- The download URL defaults to the vendor's Yunzhijia host and the initial host is allowlisted.
- The installer attempts a SHA-256 check when archive metadata supplies a checksum.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.jsView file
28const AGENT_DIRS = [
L29: ".agents/skills", // 兜底：Amp / Kiro / OpenClaw / Augment 等支持 .agents 的工具
L30: ".claude/skills",
L31: ".cursor/skills",
L32: ".gemini/skills",
L33: ".codex/skills",
L34: ".github/skills",
...
L236: const destBase = path.join(homeDir, agentDir);
L237: // 除 .agents/skills 外，父目录不存在则跳过（说明该 IDE 未安装）
L238: if (i > 0 && !fs.existsSync(path.dirname(destBase))) continue;
...
L240: fs.rmSync(dest, { recursive: true, force: true });
L241: fs.cpSync(skillSrc, dest, { recursive: true });
Critical
Findings
1 Critical4 High3 Medium4 Low
CriticalAi Agent Control Hijackscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/install.js
HighKnown Malware Source Similarityscripts/install.js
HighKnown Malware Source Fingerprint Signaturescripts/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @yunzhijia/cli@0.1.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @yunzhijia/cli@0.1.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions0.1.8latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 9, 2026, 11:44 AM0.1.7shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 17, 2026, 12:04 PM0.1.6MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 2, 2026, 11:10 AM0.1.5MaliciousSoft block: AI-agent control surfaceBlockPublished