registry / AI-agent control-surface risk / uncloud-cli
uncloud-cli
Deploy any directory to your own cloud and get a URL. Guided deploys that catch what breaks before it breaks, plus Postgres, domains and scaling — driven from your terminal, or by Claude Code and OpenAI Codex through the bundled agent skill.
This report shows the evidence for uncloud-cli@0.8.5. 2 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs automatic postinstall writes into Claude Code, Codex, and opencode skill paths. This meets the firewall block boundary for unconsented install-time mutation of foreign AI-agent control surfaces.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install executes postinstall unless UNCLOUD_SKIP_SKILL=1 or CI=true.
Impact
A package installation can alter available instructions and capabilities of unrelated AI coding agents.
Mechanism
postinstall writes a bundled SKILL.md into Claude Code, Codex, and opencode skill paths.
Policy narrative
On npm installation, postinstall calls install(). If a supported agent directory already exists, the package creates that agent's uncloud skill directory and writes its bundled instructions there. This is an unconsented install-time mutation of third-party AI-agent control surfaces, even though it has opt-outs and avoids replacing customized files.
AI rationale
The package performs automatic postinstall writes into Claude Code, Codex, and opencode skill paths. This meets the firewall block boundary for unconsented install-time mutation of foreign AI-agent control surfaces.
Evidence
package.jsonbin/postinstall.jslib/skill.jsskills/uncloud/SKILL.md~/.claude/skills/uncloud/SKILL.md~/.agents/skills/uncloud/SKILL.md~/.codex/skills/uncloud/SKILL.md~/.config/opencode/skills/uncloud/SKILL.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- npm postinstall automatically invokes the skill installer.
- Installer targets existing Claude Code, Codex, and opencode agent skill directories.
- Installer recursively creates a skill directory and writes SKILL.md into those foreign agent control surfaces.
Evidence against
- Postinstall exits without changes when CI=true or UNCLOUD_SKIP_SKILL=1.
- It avoids overwriting unmarked customized skills and leaves symlinked destinations alone.
- The inspected JavaScript has no credential harvesting or postinstall network request.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
UrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/uncloud.jsView file
10L11: const { spawnSync } = require("child_process");
L12: const path = require("path");
...
L22:
L23: const platform = process.platform; // darwin | linux
L24: const arch = process.arch === "x64" ? "amd64" : process.arch; // arm64 passes through
L25:
L26: const binary = path.join(__dirname, "..", "vendor", `${platform}-${arch}`, "uncloud");
L27:
...
L31: `Install directly instead:\n\n` +
L32: ` curl -fsSL https://uncloud-cli.vercel.app/install.sh | sh\n`
L33: );
High
Sandbox Evasion Gated Capability
Findings
1 Critical2 High4 Medium3 Low
CriticalAi Agent Control Hijacklib/skill.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybin/uncloud.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binaryvendor/darwin-amd64/uncloud
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to uncloud-cli@0.8.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing uncloud-cli@0.8.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions0.8.5latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 11, 2026, 11:57 AM0.8.4MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 11, 2026, 11:44 AM0.8.2SuspiciousAgent extension lifecycle riskWarnPublishedAug 10, 2026, 5:04 PM0.8.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 10, 2026, 9:43 AM