Loading npm security reports…

@yunzhijia/cli@0.1.4: AI-agent control-surface risk | LPM Firewall

registry / @yunzhijia/cli / 0.1.4

@yunzhijia/cli@0.1.4

Yunzhijia (云之家) CLI — manage contacts, documents, calendar events and meeting rooms from the terminal or AI Agent

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic npm lifecycle hook modifies AI-agent skill control surfaces in the user's home directory. No user command or opt-in is required for this mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs its postinstall hook.

Impact

It can alter the instructions and capabilities available to several installed AI-agent tools without the user's consent.

Mechanism

The hook deletes and copies a package skill into detected directories for multiple AI-agent products, or creates a fallback agent skill directory.

Policy narrative

During npm installation, the package automatically runs an installer. That installer discovers multiple AI-agent skill locations below the user's home directory, removes any existing yzj-cli skill there, and replaces it with the package's skill content. It performs this across several unrelated agent products and creates a fallback agent directory if none are detected. This is an unconsented, broad AI-agent control-surface mutation at install time.

AI rationale

The postinstall hook performs cross-product AI-agent skill deployment into home-directory control surfaces. This meets the blocking policy for unconsented install-time mutation of a foreign or broad AI-agent control surface.

Evidence

package.jsonscripts/install.js

Network endpoints1

www.yunzhijia.com/mixed/yzj-cli

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"scripts": { "postinstall": "node ./scripts/install.js", "build:debug": "cargo build",

High

Suspicious Lifecycle Evidence

The package runs scripts/install.js automatically through postinstall.

package.jsonView on unpkg · L21

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

28const AGENT_DIRS = [ L29: ".agents/skills", // 兜底：Amp / Kiro / OpenClaw / Augment 等支持 .agents 的工具 L30: ".claude/skills", L31: ".cursor/skills", L32: ".gemini/skills", L33: ".codex/skills", L34: ".github/skills", ... L235: const destBase = path.join(homeDir, agentDir); L236: // 除 .agents/skills 外，父目录不存在则跳过（说明该 IDE 未安装） L237: if (i > 0 && !fs.existsSync(path.dirname(destBase))) continue; ... L239: fs.rmSync(dest, { recursive: true, force: true }); L240: fs.cpSync(skillSrc, dest, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L28

5* L6: * CDN 路径：https://www.yunzhijia.com/mixed/yzj-cli/$platform/$channel/yzj-cli-$version.pak L7: * channel 由 package.json 的 publishConfig.tag 决定：latest 映射为 release，其他 tag 映射为 beta。 L8: * pak 是 zip，内含： ... L21: const path = require("path"); L22: const { execFileSync } = require("child_process"); L23: const os = require("os"); ... L40: L41: const PKG = JSON.parse( L42: fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8") L43: ); ... L45: const CDN_BASE = (

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L5

28const AGENT_DIRS = [ ".agents/skills", // 兜底：Amp / Kiro / OpenClaw / Augment 等支持 .agents 的工具 ".claude/skills", ".cursor/skills", ".gemini/skills", ".codex/skills", ".github/skills", ".windsurf/skills", ".cline/skills", ".trae/skills", ".hermes/skills", ];

High

Ai Review Evidence

The installer targets skill directories for numerous unrelated AI-agent products in the user's home directory.

scripts/install.jsView on unpkg · L28