Loading npm security reports…

uncloud-cli@0.8.5: AI-agent control-surface risk | LPM Firewall

registry / uncloud-cli / 0.8.5

uncloud-cli@0.8.5

Deploy any directory to your own cloud and get a URL. Guided deploys that catch what breaks before it breaks, plus Postgres, domains and scaling — driven from your terminal, or by Claude Code and OpenAI Codex through the bundled agent skill.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically adds an Uncloud instruction skill to already-present third-party coding-agent directories. This changes agent behavior without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install executes postinstall unless UNCLOUD_SKIP_SKILL=1 or CI=true.

Impact

A package installation can alter available instructions and capabilities of unrelated AI coding agents.

Mechanism

postinstall writes a bundled SKILL.md into Claude Code, Codex, and opencode skill paths.

Policy narrative

On npm installation, postinstall calls install(). If a supported agent directory already exists, the package creates that agent's uncloud skill directory and writes its bundled instructions there. This is an unconsented install-time mutation of third-party AI-agent control surfaces, even though it has opt-outs and avoids replacing customized files.

Rationale

The package performs automatic postinstall writes into Claude Code, Codex, and opencode skill paths. This meets the firewall block boundary for unconsented install-time mutation of foreign AI-agent control surfaces.

Evidence

package.jsonbin/postinstall.jslib/skill.jsskills/uncloud/SKILL.md~/.claude/skills/uncloud/SKILL.md~/.agents/skills/uncloud/SKILL.md~/.codex/skills/uncloud/SKILL.md~/.config/opencode/skills/uncloud/SKILL.md

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/uncloud.jsView file

10L11: const { spawnSync } = require("child_process"); L12: const path = require("path"); ... L22: L23: const platform = process.platform; // darwin | linux L24: const arch = process.arch === "x64" ? "amd64" : process.arch; // arm64 passes through L25: L26: const binary = path.join(__dirname, "..", "vendor", `${platform}-${arch}`, "uncloud"); L27: ... L31: `Install directly instead:\n\n` + L32: ` curl -fsSL https://uncloud-cli.vercel.app/install.sh | sh\n` L33: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/uncloud.jsView on unpkg · L10

lib/skill.jsView file

9* Nothing is created speculatively. A directory is written only where that L10: * agent is already set up — installing uncloud never conjures a ~/.claude L11: * for someone who has never run Claude Code. ... L42: label: "Claude Code", L43: dir: path.join(home, ".claude"), L44: skills: path.join(home, ".claude", "skills"), L45: }, ... L48: label: "Codex", L49: // Codex reads ~/.agents/skills. It also creates ~/.codex for its own L50: // config, so keying off that directory looked right and installed into a ... L52: // success, and did nothing. Prefer the directory it actually reads, and L53: // fall back to the older location only when ~/.agents is absent.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/skill.jsView on unpkg · L9

vendor/darwin-amd64/uncloudView file

•path = vendor/darwin-amd64/uncloud kind = native_binary sizeBytes = 7268512 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/darwin-amd64/uncloudView on unpkg