Loading npm security reports…

llm-wiki-loop@1.3.2: AI-agent control-surface risk | LPM Firewall

registry / llm-wiki-loop / 1.3.2

llm-wiki-loop@1.3.2

The production framework for self-improving & self-organizing LLM knowledge vaults — grounding invariants, code drift detection, auto-skillification, and 1-click multi-agent setup.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package mutates detected Claude, OpenCode, Codex/Agents, Cursor, Gemini, CommandCode, and Windsurf skill control surfaces. It replaces the installed wiki-manager skill and prompts the runtime to load it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Unconsented persistence of package-supplied agent instructions across broad agent runtimes.

Mechanism

automatic cross-runtime AI-agent skill installation

Policy narrative

Installing the package invokes its postinstall script. When recognized runtime markers exist, it deletes any existing wiki-manager directory and copies its bundled skill into each detected agent runtime; global installs target home directories. This is an unconsented lifecycle mutation of foreign, broad AI-agent control surfaces.

Rationale

The concrete postinstall behavior meets the firewall block criterion for foreign/broad AI-agent control-surface mutation. No separate network or credential-exfiltration behavior was found.

Evidence

package.jsonscripts/install.jsskills/wiki-manager/SKILL.md.claude/skills/wiki-manager.config/opencode/skills/wiki-manager.agents/skills/wiki-manager.cursor/skills/wiki-manager.gemini/skills/wiki-manager.commandcode/skills/wiki-manager.windsurf/skills/wiki-manager

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

40"prepack": "npm run sync:version --silent", "postinstall": "node scripts/install.js"

High

Suspicious Lifecycle Evidence

postinstall automatically runs scripts/install.js.

package.jsonView on unpkg · L40

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

7L8: const fs = require('fs'); L9: const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L7

scripts/install.jsView file

5// Global install (npm i -g): copies into the home skill dirs of detected L6: // runtimes (Claude Code ~/.claude/skills, opencode ~/.config/opencode/skills, L7: // Codex CLI ~/.agents/skills). L8: // L9: // Project install (npm i in a project): copies into the project's runtime L10: // skill dirs (.claude/skills, .opencode/skills, .agents/skills, L11: // .cursor/skills) whose base directory already exists, or falls back to L12: // .agents/skills (Open Agent standard). L13: ... L21: const GLOBAL_RUNTIMES = [ L22: { marker: path.join(HOME, ".claude"), dir: path.join(HOME, ".claude", "skills") }, L23: { marker: path.join(HOME, ".config", "opencode"), dir: path.join(HOME, ".config", "opencode", "skills") },

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L5

skills/wiki-manager/scripts/check_evidence.pyView file

•path = skills/wiki-manager/scripts/check_evidence.py kind = build_helper sizeBytes = 24648 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/wiki-manager/scripts/check_evidence.pyView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 20-51json

20 "llm-wiki": "bin/cli.js",

21 "llm-wiki-loop": "bin/cli.js"

22 },

23 "files": [

24 "bin",

25 "skills",

26 "scripts",

27 "README.md",

28 "SPEC.md",

29 "AGENTS.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "lint": "node --check bin/cli.js && node --check scripts/install.js && node --check scripts/sync-version.js && node --check scripts/scan-skill-candidates.js && py -m py_compile skills/wiki-manager/scripts/check_evidence.py || python -m py_compile skills/wiki-manager/scripts/check_evidence.py || python3 -m py_compile skills/wiki-manager/scripts/check_evidence.py",

34 "wiki:lint": "node bin/cli.js check --strict .",

35 "lint:all": "npm run lint --silent && npm run wiki:lint --silent && npm run scan:skills --silent",

36 "test": "node scripts/run-tests.js",

37 "test:cli": "node bin/cli.js doctor",

38 "sync:version": "node scripts/sync-version.js",

39 "scan:skills": "node scripts/scan-skill-candidates.js",

40 "prepack": "npm run sync:version --silent",

41 "postinstall": "node scripts/install.js"

High

Suspicious Lifecycle Evidence

postinstall automatically runs scripts/install.js.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "engines": {

44 "node": "\u003e=18.0.0"

45 },

46 "homepage": "https://github.com/PALAN-K/llm-wiki-loop#readme",

47 "repository": {

48 "type": "git",

49 "url": "git+https://github.com/PALAN-K/llm-wiki-loop.git"

50 }

51}

bin/cli.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/**

4 * llm-wiki-loop CLI

5 * The production framework for self-improving & self-organizing LLM knowledge vaults.

6 */

7

8const fs = require('fs');

9const

scripts/install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Installs the wiki-manager skill into detected agent runtimes.

3// Postinstall-safe: never fails an npm install; prints guidance instead.

4//

5// Global install (npm i -g): copies into the home skill dirs of detected

6// runtimes (Claude Code ~/.claude/skills, opencode ~/.config/opencode/skills,

7// Codex CLI ~/.agents/skills).

8//

9// Project install (npm i in a project): copies into the project's runtime

10// skill dirs (.claude/skills, .opencode/skills, .agents/skills,

skills/wiki-manager/scripts/check_evidence.pyView file

•path = skills/wiki-manager/scripts/check_evidence.py kind = build_helper sizeBytes = 24648 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/wiki-manager/scripts/check_evidence.pyView on unpkg