Loading npm security reports…

uniner-cli-rpa@1.0.0: AI-agent control-surface risk | LPM Firewall

registry / uniner-cli-rpa / 1.0.0

uniner-cli-rpa@1.0.0

uniner-cli-rpa — RPA automation CLI with cloud flow publish: browser automation (Playwright/CDP), Excel, OCR, desktop/SAP, crypto/HTTP/email tools. Includes uniner-cloud-flow skill for publishing flows to Uniner Cloud.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package downloads remote content and writes it as globally available Claude skills. The downloaded content can choose additional skill names.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation.

Impact

A remote publisher can install behavior-bearing AI-agent instructions without an explicit user setup command.

Mechanism

Remote archive content is written into user-global Claude skill paths.

Policy narrative

The postinstall hook retrieves metadata and a portable archive from a remote endpoint. It then scans the downloaded archive for Markdown files, takes each file's frontmatter name, and writes it to a corresponding directory under the user's global Claude skills folder. This creates a remote-controlled AI-agent instruction channel during installation, without an explicit setup command or a restriction to the package-owned skill path.

Rationale

The package performs unconsented postinstall writes to broad user-global Claude skill paths using remotely supplied content and names. This is a concrete AI-agent control-surface mutation, not merely a package-owned setup.

Evidence

package.jsonscripts/postinstall.jslib/paths.jslib/SKILL.md.template~/.uniner-cli-rpa/<version>/~/.claude/skills/uniner-cli-rpa/SKILL.md~/.claude/skills/<skill-name>/SKILL.md

Network endpoints1

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

12// 6. Render SKILL.md.template with {{INSTALL_PATH}} / {{VERSION}} substituted L13: // and write to ~/.claude/skills/uniner-cli-rpa/SKILL.md. L14: // 7. Print "ready" and how to validate. ... L215: const dir = skillDir(); L216: fs.mkdirSync(dir, { recursive: true }); L217: L218: // IMPORTANT: only writeFileSync the single SKILL.md file. Do NOT touch L219: // anything else under ~/.claude/skills/uniner-cli-rpa/. In particular, the L220: // scenarios/ subdirectory is the user's accumulated knowledge — if we ... L222: // upgrade. Single-file write is the contract. L223: fs.writeFileSync(skillFile(), content, 'utf8'); L224: log(` SKILL.md written to ${skillFile()}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

10// 4. Verify SHA-256. L11: // 5. Extract via PowerShell's Expand-Archive (no native dep). L12: // 6. Render SKILL.md.template with {{INSTALL_PATH}} / {{VERSION}} substituted ... L24: const os = require('os'); L25: const https = require('https'); L26: const crypto = require('crypto'); ... L87: res.on('end', () => { L88: try { resolve(JSON.parse(buf)); } L89: catch (e) { reject(new Error(`Bad JSON from ${url}: ${e.message}`)); } ... L123: received += chunk.length; L124: file.write(chunk); L125:

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ync(skilldir, { recursive: true }); fs.writefilesync(destpath, content, 'utf8'); log(` skill installed: ${skillname} → ${destpath}`); installedcount++; } catch (e) { log(` [warn] failed to install skill ${skillfile}: ${e.message}`); } } if (installedcount > 0) { log(` total skills installed: ${installedcount}`); } }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 10-50json

10 "excel",

11 "ocr",

12 "claude-code",

13 "ai-agent",

14 "cloud-flow",

15 "uniner-cloud"

16 ],

17 "homepage": "https://www.uniner.com/",

18 "bugs": {

19 "url": "https://www.uniner.com/",

20 "email": "support@uniner.com"

21 },

22 "license": "Proprietary",

23 "author": "Uniner Tech",

24 "main": "lib/paths.js",

25 "bin": {

26 "uniner-cli-rpa": "bin/uniner-cli-rpa.js",

27 "uniner-cli-rpa-uninstall": "bin/uniner-cli-rpa-uninstall.js"

28 },

29 "scripts": {

30 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "preuninstall": "node scripts/preuninstall.js"

32 },

33 "engines": {

34 "node": ">=14"

35 },

36 "os": [

37 "win32",

38 "darwin",

39 "linux"

40 ],

41 "cpu": [

42 "x64",

43 "arm64"

44 ],

45 "files": [

46 "bin/",

47 "lib/",

48 "scripts/",

49 "README.md",

50 "LICENSE"

scripts/postinstall.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// postinstall.js — runs after `npm install -g uniner-cli-rpa`.

3//

4// What it does:

5// 1. If the binary is already in place at ~/.uniner-cli-rpa/<version>/, exit (idempotent).

6// 2. Fetch latest.json from the OSS metadata URL to get portable_url + sha256.

7// 3. Stream-download the matching portable .zip into %TEMP%.

8// - Live progress every 2 seconds.

9// - Up to 3 retries with exponential backoff.

10// 4. Verify SHA-256.