Loading npm security reports…

uncloud-cli@0.8.4: AI-agent control-surface risk | LPM Firewall

registry / uncloud-cli / 0.8.4

uncloud-cli@0.8.4

Deploy any directory to your own cloud and get a URL. Guided deploys that catch what breaks before it breaks, plus Postgres, domains and scaling — driven from your terminal, or by Claude Code and OpenAI Codex through the bundled agent skill.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall writes a bundled skill into pre-existing third-party AI-agent skill directories. This modifies agent behavior without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of uncloud-cli

Impact

Claude Code, Codex, or opencode may load instructions enabling uncloud infrastructure operations.

Mechanism

postinstall writes agent SKILL.md files

Policy narrative

Installing the package runs postinstall, which detects existing Claude Code, Codex, and opencode directories and writes the bundled uncloud skill into their skill locations. The skill is then available to influence agent-led deployment and cloud-management actions. Although it avoids overwriting unmarked files and offers opt-outs, the mutation occurs automatically during npm installation across foreign agent control surfaces.

Rationale

This is a concrete unconsented postinstall mutation of multiple third-party AI-agent control surfaces, meeting the block boundary. The bundled native binaries are opaque but are not required for this verdict.

Evidence

package.jsonbin/postinstall.jslib/skill.jsskills/uncloud/SKILL.md~/.claude/skills/uncloud/SKILL.md~/.agents/skills/uncloud/SKILL.md~/.codex/skills/uncloud/SKILL.md~/.config/opencode/skills/uncloud/SKILL.md

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

58"scripts": { "postinstall": "node bin/postinstall.js" }

High

Suspicious Lifecycle Evidence

postinstall invokes skill installation automatically.

package.jsonView on unpkg · L58

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/uncloud.jsView file

10L11: const { spawnSync } = require("child_process"); L12: const path = require("path"); ... L22: L23: const platform = process.platform; // darwin | linux L24: const arch = process.arch === "x64" ? "amd64" : process.arch; // arm64 passes through L25: L26: const binary = path.join(__dirname, "..", "vendor", `${platform}-${arch}`, "uncloud"); L27: ... L31: `Install directly instead:\n\n` + L32: ` curl -fsSL https://uncloud-cli.vercel.app/install.sh | sh\n` L33: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/uncloud.jsView on unpkg · L10

lib/skill.jsView file

9* Nothing is created speculatively. A directory is written only where that L10: * agent is already set up — installing uncloud never conjures a ~/.claude L11: * for someone who has never run Claude Code. ... L42: label: "Claude Code", L43: dir: path.join(home, ".claude"), L44: skills: path.join(home, ".claude", "skills"), L45: }, ... L48: label: "Codex", L49: // Codex reads ~/.agents/skills. It also creates ~/.codex for its own L50: // config, so keying off that directory looked right and installed into a ... L52: // success, and did nothing. Prefer the directory it actually reads, and L53: // fall back to the older location only when ~/.agents is absent.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/skill.jsView on unpkg · L9

vendor/darwin-amd64/uncloudView file

•path = vendor/darwin-amd64/uncloud kind = native_binary sizeBytes = 7260192 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/darwin-amd64/uncloudView on unpkg

bin/postinstall.jsView file

18const { install } = require("../lib/skill"); const results = install();

High

Suspicious Lifecycle Evidence

postinstall invokes skill installation automatically.

bin/postinstall.jsView on unpkg · L18

Source & flagged code

7 flagged

package.jsonView file

Lines 38-62json

38 "hosting",

39 "kubernetes",

40 "claude-code",

41 "ai-agents",

42 "codex",

43 "openai",

44 "claude",

45 "anthropic",

46 "agent-skill"

47 ],

48 "homepage": "https://uncloud.club/cli",

49 "repository": {

50 "type": "git",

51 "url": "git+https://github.com/TeamDukaan/dukaanUnCloud.git",

52 "directory": "cli"

53 },

54 "bugs": {

55 "url": "https://github.com/TeamDukaan/dukaanUnCloud/issues"

56 },

57 "license": "MIT",

58 "scripts": {

59 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 }

High

Suspicious Lifecycle Evidence

postinstall invokes skill installation automatically.

package.jsonView on unpkg · L58

61}

62

bin/uncloud.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * Thin launcher: pick the binary for this platform and hand the process over.

4 *

5 * The Go binaries ship inside the package rather than being fetched in a

6 * postinstall, so `npm i -g @uncloud/cli` works behind a proxy, in a locked-down

7 * CI runner, and from an npm cache with no network at all.

8 */

9"use strict";

10

11const

lib/skill.jsView file

Lines 1-29javascript

1/**

2 * Install the uncloud agent skill into whichever coding agents are on this

3 * machine.

4 *

5 * Installing the CLI is the moment the skill becomes useful, so it happens

6 * then rather than being a second thing to discover in the docs. What makes

7 * that acceptable rather than intrusive:

8 *

9 * Nothing is created speculatively. A directory is written only where that

10 * agent is already set up — installing uncloud never conjures a ~/.claude

11

vendor/darwin-amd64/uncloudView file

•path = vendor/darwin-amd64/uncloud kind = native_binary sizeBytes = 7260192 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/darwin-amd64/uncloudView on unpkg

bin/postinstall.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Runs after `npm i -g uncloud-cli`.

4 *

5 * Its only job is to put the agent skill where the coding agents on this

6 * machine will find it, and to say so in one line. It must never fail the

7 * install: npm treats a non-zero postinstall as a failed package, and a

8 * missing skill is not worth a failed CLI.

9 */

10"use strict";

11