registry / AI-agent control-surface risk / kaijibot
kaijibot
Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.
This report shows the evidence for kaijibot@2026.10.23. 23 of 42 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe manifest activates a postinstall script that installs third-party agent skills globally without affirmative consent. This is a concrete mutation of a broad agent surface, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package with lifecycle scripts enabled, unless the opt-out is set or matching skills are already present.
Impact
Agents that load skills from this directory may receive new third-party capabilities or instructions.
Mechanism
The hook runs npx with a global install command for all skills from larksuite/cli, using the user’s home directory.
Policy narrative
On npm installation, package.json launches a postinstall script that installs all skills from larksuite/cli into ~/.agents/skills. The operation runs automatically unless disabled through an environment variable or skipped because matching skills are already installed. This is an unconsented global change to the agent skills surface.
AI rationale
The manifest activates a postinstall script that installs third-party agent skills globally without affirmative consent. This is a concrete mutation of a broad agent surface, so the package should be blocked.
Evidence
package.jsonscripts/postinstall-bundled-plugins.mjs~/.agents/skills
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall-bundled-plugins.mjs on install.
- The script automatically calls installLarkCliSkills when run directly.
- That function targets ~/.agents/skills; its only affirmative bypass is an environment opt-out, and it skips when matching skills are already present.
- It runs npx to add all larksuite/cli skills globally from the user’s home directory.
- The indicated workspace excerpt creates a file only if it does not already exist; the indicated plugin installer excerpt lazily loads its runtime.
- The inspected session helper excerpt parses a session key into fields.
Evidence against
- The script skips the global skills install for source checkouts or when matching Lark skills are already present.
- The package provides an environment variable to disable the global skills install, but does not require affirmative consent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/resolve-B-YGj7MS.jsView file
3import { basename, dirname, join } from "node:path";
L4: import { execSync } from "node:child_process";
L5: //#region src/infra/lark-cli/resolve.ts
High
Child Process
Package source references child process execution.
dist/resolve-B-YGj7MS.jsView on unpkg · L3dist/extensions/diffs/node_modules/playwright-core/lib/tools/cli-client/program.jsView file
Findings
1 Critical9 High10 Medium7 Low
CriticalTrojan Source Unicodedist/control-ui/assets/index-BtNFbQhY.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/resolve-B-YGj7MS.js
HighShelldist/extensions/diffs/node_modules/playwright-core/lib/tools/cli-client/program.js
HighSame File Env Network Executiondist/extensions/diffs/node_modules/playwright-core/lib/utilsBundleImpl/index.js
HighCommand Output Exfiltrationdist/extensions/diffs/node_modules/playwright-core/lib/utilsBundleImpl/index.js
HighCross File Remote Execution Contextdist/compact-lqt6mZJz.js
HighSemantic Analysis Limiteddist/exec-defaults-Cs1FwIKH.js#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/postinstall-bundled-plugins.mjs
Affected versions and remediation
This report applies to kaijibot@2026.10.23.
The versions list below shows the verdict for each recorded version.
- Avoid installing kaijibot@2026.10.23. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
42 known versions2026.10.23latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 23, 2026, 3:30 AM2026.8.29MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 28, 2026, 5:16 PM2026.8.23MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 23, 2026, 10:01 AM2026.8.21-1MaliciousSoft block: AI-agent control surfaceBlockPublished