registry / AI-agent control-surface risk / llm-wiki-loop

llm-wiki-loop

The production framework for self-improving & self-organizing LLM knowledge vaults — grounding invariants, code drift detection, auto-skillification, and 1-click multi-agent setup.

This report shows the evidence for llm-wiki-loop@1.3.2. 6 of 9 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The concrete postinstall behavior meets the firewall block criterion for foreign/broad AI-agent control-surface mutation. No separate network or credential-exfiltration behavior was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Unconsented persistence of package-supplied agent instructions across broad agent runtimes.

Mechanism

automatic cross-runtime AI-agent skill installation

Policy narrative

Installing the package invokes its postinstall script. When recognized runtime markers exist, it deletes any existing wiki-manager directory and copies its bundled skill into each detected agent runtime; global installs target home directories. This is an unconsented lifecycle mutation of foreign, broad AI-agent control surfaces.

AI rationale

The concrete postinstall behavior meets the firewall block criterion for foreign/broad AI-agent control-surface mutation. No separate network or credential-exfiltration behavior was found.

Evidence

package.jsonscripts/install.jsskills/wiki-manager/SKILL.md.claude/skills/wiki-manager.config/opencode/skills/wiki-manager.agents/skills/wiki-manager.cursor/skills/wiki-manager.gemini/skills/wiki-manager.commandcode/skills/wiki-manager.windsurf/skills/wiki-manager

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall automatically runs scripts/install.js.
Install script targets skill directories for seven separate AI-agent runtimes.
The lifecycle script recursively replaces and copies wiki-manager into detected runtime skill paths.

Evidence against

No network, credential collection, or exfiltration code found.
Dependency installs inside node_modules skip the fallback skill installation.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 39.1 KB of source, external domains: github.com, python.org

Source & flagged code

6 flagged

package.jsonView file

Lines 20-51json

20 "llm-wiki": "bin/cli.js",

21 "llm-wiki-loop": "bin/cli.js"

22 },

23 "files": [

24 "bin",

25 "skills",

26 "scripts",

27 "README.md",

28 "SPEC.md",

29 "AGENTS.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "lint": "node --check bin/cli.js && node --check scripts/install.js && node --check scripts/sync-version.js && node --check scripts/scan-skill-candidates.js && py -m py_compile skills/wiki-manager/scripts/check_evidence.py || python -m py_compile skills/wiki-manager/scripts/check_evidence.py || python3 -m py_compile skills/wiki-manager/scripts/check_evidence.py",

34 "wiki:lint": "node bin/cli.js check --strict .",

35 "lint:all": "npm run lint --silent && npm run wiki:lint --silent && npm run scan:skills --silent",

36 "test": "node scripts/run-tests.js",

37 "test:cli": "node bin/cli.js doctor",

38 "sync:version": "node scripts/sync-version.js",

39 "scan:skills": "node scripts/scan-skill-candidates.js",

40 "prepack": "npm run sync:version --silent",

41 "postinstall": "node scripts/install.js"

High

Suspicious Lifecycle Evidence

postinstall automatically runs scripts/install.js.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "engines": {

44 "node": "\u003e=18.0.0"

45 },

46 "homepage": "https://github.com/PALAN-K/llm-wiki-loop#readme",

47 "repository": {

48 "type": "git",

49 "url": "git+https://github.com/PALAN-K/llm-wiki-loop.git"

50 }

51}

bin/cli.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * llm-wiki-loop CLI

5 * The production framework for self-improving & self-organizing LLM knowledge vaults.

6 */

8const fs = require('fs');

9const

scripts/install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Installs the wiki-manager skill into detected agent runtimes.

3// Postinstall-safe: never fails an npm install; prints guidance instead.

4//

5// Global install (npm i -g): copies into the home skill dirs of detected

6// runtimes (Claude Code ~/.claude/skills, opencode ~/.config/opencode/skills,

7// Codex CLI ~/.agents/skills).

8//

9// Project install (npm i in a project): copies into the project's runtime

10// skill dirs (.claude/skills, .opencode/skills, .agents/skills,

skills/wiki-manager/scripts/check_evidence.pyView file

•path = skills/wiki-manager/scripts/check_evidence.py kind = build_helper sizeBytes = 24648 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/wiki-manager/scripts/check_evidence.pyView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"prepack": "npm run sync:version --silent", "postinstall": "node scripts/install.js"

High

Suspicious Lifecycle Evidence

postinstall automatically runs scripts/install.js.

package.jsonView on unpkg · L40

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/cli.js

MediumEnvironment Vars

MediumShips Build Helperskills/wiki-manager/scripts/check_evidence.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to llm-wiki-loop@1.3.2.

The versions list below shows the verdict for each recorded version.

Avoid installing llm-wiki-loop@1.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-21 14:14:57.356Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

1.3.2latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 21, 2026, 2:11 PM 1.3.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 21, 2026, 1:02 AM 1.3.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 20, 2026, 9:51 AM 1.2.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 19, 2026, 10:02 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code