Loading npm security reports…

gaoding-cli@1.0.0-alpha.12: AI-agent control-surface risk | LPM Firewall

registry / gaoding-cli / 1.0.0-alpha.12

gaoding-cli@1.0.0-alpha.12

Gaoding command-line interface for agents and people.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A postinstall hook automatically writes the bundled skill into detected third-party AI-agent skill directories during supported global installation. This is an unconsented, broad agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm/pnpm global installation that passes the lifecycle environment checks.

Impact

Modifies agent instruction/extension surfaces without an explicit user command.

Mechanism

postinstall synchronizes bundled skills into multiple agent-host directories.

Policy narrative

Installing this package globally triggers postinstall. When its environment checks pass, it loads the package's bundled skill and synchronizes it to a canonical skills directory plus any detected Claude Code, Codex, Cursor, OpenCode, OpenClaw, or WorkBuddy skill directories. The installer can copy, replace managed directories, or create links. This mutates broad foreign AI-agent control surfaces without requiring the user to invoke the CLI's update/setup command.

Rationale

The source confirms install-time mutation of multiple foreign AI-agent skill locations. The global-install guard reduces reach but does not make the mutation consensual. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsondist/bin/postinstall.jsdist/src/features/skill/installer.jsskills/gd-cli/SKILL.mdskills/gd-cli~/.agents/skills/gd-cli~/.claude/skills/gd-cli~/.codex/skills/gd-cli

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/features/dam/object-storage.jsView file

12try { L13: const url = new URL(value.includes("://") ? value : `https://${value}`); L14: if (url.protocol !== "http:" && url.protocol !== "https:") { ... L128: .update(stringToSign) L129: .digest("base64"); L130: const stream = createReadStream(input.filePath); ... L140: }, L141: body: stream, L142: signal: input.signal,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/features/dam/object-storage.jsView on unpkg · L12

dist/src/features/update/update-service.jsView file

1import { spawn } from "node:child_process"; L2: import { realpathSync } from "node:fs"; ... L5: import { syncBundledSkills, verifyBundledSkills } from "../skill/installer.js"; L6: const REGISTRY_URL = "https://registry.npmjs.org/gaoding-cli"; L7: export class UpdateError extends Error { ... L21: const cwd = normalizePath(resolve(input.cwd)); L22: const userAgent = input.env.npm[redacted] ?? ""; L23: const npmExecPath = normalizePath(input.env.npm_execpath ?? ""); ... L80: packageRoot: options.packageRoot, L81: cwd: options.cwd ?? process.cwd(), L82: env ... L123: throw new Error(`Registry status ${response.status}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/features/update/update-service.jsView on unpkg · L1

dist/src/platform/url-safety.jsView file

1import { isIP } from "node:net"; L2: export class UrlSafetyError extends Error { ... L15: } L16: function isPrivateIpv4(parts) { L17: const first = parts[0] ?? -1;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/src/platform/url-safety.jsView on unpkg · L1

Source & flagged code

5 flagged

package.jsonView file

Lines 34-56json

34 "ws": "8.21.1"

35 },

36 "devDependencies": {

37 "@types/ali-oss": "6.23.3",

38 "@types/node": "24.13.3",

39 "@types/qrcode": "1.5.6",

40 "@types/semver": "7.7.1",

41 "@types/ws": "8.18.1",

42 "typescript": "7.0.2",

43 "vitest": "4.1.10",

44 "@gaoding/gd-connector-contracts": "0.1.0"

45 },

46 "scripts": {

47 "contracts:build": "pnpm --filter @gaoding/gd-connector-contracts build",

48 "clean": "node -e \"for (const p of ['contracts', 'dist']) require('node:fs').rmSync(p, { recursive: true, force: true })\"",

49 "bundle:contracts": "node scripts/bundle-contracts.mjs",

50 "build": "pnpm contracts:build && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

51 "test": "pnpm contracts:build && vitest run",

52 "typecheck": "pnpm contracts:build && tsc -p tsconfig.json",

53 "check": "pnpm contracts:build && vitest run && tsc -p tsconfig.json && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

54 "postinstall": "node -e \"const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L54

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 }

56}

dist/src/features/dam/object-storage.jsView file

Lines 1-32javascript

1import { createHmac } from "node:crypto";

2import { createReadStream } from "node:fs";

3import { stat } from "node:fs/promises";

4import OSS from "ali-oss"

dist/src/features/update/update-service.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { realpathSync } from "node:fs";

3import { resolve } from "node:path";

4import { gt, valid } from "semver"

dist/src/platform/url-safety.jsView file

Lines 1-21javascript

1import { isIP } from "node:net";

2export class UrlSafetyError extends Error {

3 constructor() {

4 super("URL 不可用于远程素材。");