Loading npm security reports…

dingtalk-workspace-cli@1.0.60: AI-agent control-surface risk | LPM Firewall

registry / dingtalk-workspace-cli / 1.0.60

dingtalk-workspace-cli@1.0.60

DingTalk Workspace CLI - AI-powered productivity tools

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall runs install.js, unpacks bundled skills, and writes them into the shared user agent skill store plus detected third-party agent skill directories. There is no consent prompt. Installed coding agents can load those skills after a normal package install.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of dingtalk-workspace-cli, which runs the postinstall script.

Impact

Claude Code, Cursor, Copilot, Grok, and other detected agents can execute DingTalk-supplied skill instructions without an explicit setup command.

Mechanism

unconsented postinstall write of bundled skills into foreign and shared AI-agent skill directories

Policy narrative

On npm install, postinstall runs install.js with no consent prompt. The script unpacks bundled dws-skills.zip and always writes those skills into the shared ~/.agents/skills directory. It then walks a registry of dozens of third-party coding agents and, when their config parents exist, copies or links the same skills into those agents skill folders, including Claude Code and others. Universal agents that read the shared store still receive the payload through ~/.agents/skills. Installed agents can therefore load DingTalk-supplied skill instructions after a dependency install the user did not treat as agent configuration.

AI rationale

The postinstall hook performs unconsented writes of bundled agent skills into the shared ~/.agents/skills store and into detected third-party agent skill directories, which is foreign and broad AI-agent control-surface mutation. The JS installer does not exfiltrate secrets, but that does not make the install-time hijack package-aligned or consented.

Evidence

package.jsoninstall.jsassets/dws-skills.zipshare/skills

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

22["augment", false, ".augment/skills"], ["bob", false, ".bob/skills"], L23: ["claude-code", false, ".claude/skills"], ["openclaw", false, ".openclaw/skills"], L24: ["cline", true, ".agents/skills"], ["codearts-agent", false, ".codeartsdoer/skills"], L25: ["codebuddy", false, ".codebuddy/skills"], ["codemaker", false, ".codemaker/skills"], L26: ["codestudio", false, ".codestudio/skills"], ["codex", true, ".codex/skills"], L27: ["command-code", false, ".commandcode/skills"], ["continue", false, ".continue/skills"], ... L29: ["cursor", true, ".cursor/skills"], ["deepagents", true, ".deepagents/agent/skills"], L30: ["devin", false, ".config/devin/skills"], ["dexto", true, ".agents/skills"], L31: ["droid", false, ".factory/skills"], ["eve", false, null], ... L37: ["iflow-cli", false, ".iflo

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L22

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ls"], ["ona", false, ".ona/skills"], ["pi", false, ".pi/agent/skills"], ["qoder", false, ".qoder/skills"], ["qoder-cn", false, ".qoder-cn/skills"], ["qwen-code", false, ".qwen/skills"], ["replit", true, ".config/agents/skills"], ["reasonix", false, ".reasonix/skills"], ["rovodev", false, ".rovodev/skills"], ["roo", false, ".roo/skills"], ["tabnine-cli", false, ".tabnine/agent/skills"], ["terramind", false, ".terramind/skills"], ["tinycloud", false, ".tinycloud/skills"], ["trae", false, ".trae/skills"], ["trae-cn", false, ".trae-cn/skills"], ["warp", true, ".agents/skills"], ["windsurf", false, ".codeium/windsurf/skills"], ["zed", true, ".agents/skills"], ["zcod

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.jsView on unpkg

assets/dws-windows-amd64.zipView file

•path = assets/dws-windows-amd64.zip kind = high_entropy_blob sizeBytes = 12126374 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/dws-windows-amd64.zipView on unpkg

•path = assets/dws-windows-amd64.zip kind = compressed_blob sizeBytes = 12126374 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/dws-windows-amd64.zipView on unpkg

•path = assets/dws-windows-amd64.zip kind = nested_archive_needs_inspection sizeBytes = 12126374 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/dws-windows-amd64.zipView on unpkg