Loading npm security reports…

yuanflow-cli@0.1.87: AI-agent control-surface risk | LPM Firewall

registry / yuanflow-cli / 0.1.87

yuanflow-cli@0.1.87

Public distribution has been discontinued. Do not install or use this package. Contact YuanFlow for authorized access.

YuanFlow 自媒体 API CLI 与 Skill 安装器。

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation automatically detects AI agents and installs a large YuanFlow skill bundle into their skill directories. It removes existing same-named targets before creating symlinks or copies.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global install executes the postinstall hook.

Impact

Unconsented modification of installed AI-agent control surfaces; installed instructions become available to those agents.

Mechanism

automatic cross-agent skill-directory mutation

Policy narrative

On a global npm install, the postinstall hook invokes the skill installer without an explicit install command. It detects configured directories for Codex, Claude Code, Cursor, and other agents, removes the package's target skill directory if present, then symlinks or copies the bundled skills into each detected agent. This is unconsented postinstall mutation of foreign AI-agent control surfaces.

Rationale

The automatic global postinstall materially alters third-party agent skill directories, rather than merely preparing this package. The skip flag and marker checks do not provide user consent or prevent broad cross-agent mutation.

Evidence

package.jsonbin/yuanflow-skill.cjslib/skill-installer/agents.cjslib/skill-installer/installer.cjslib/skill-installer/repo-source.cjsskills/yuanflow-skill

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/yuanflow-skill.cjs install --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/yuanflow-skill.cjs install --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/yuanflow-skill.cjsView file

4const path = require('node:path'); L5: const { execFileSync } = require('node:child_process'); L6:

High

Child Process

Package source references child process execution.

bin/yuanflow-skill.cjsView on unpkg · L4

src/video/doctor.jsView file

118if (os.platform() === 'win32') { L119: const result = spawnSync('powershell.exe', [ L120: '-NoProfile',

High

Shell

Package source references shell execution.

src/video/doctor.jsView on unpkg · L118

src/video/recorder.jsView file

1import { spawn } from 'node:child_process'; L2: import { existsSync } from 'node:fs'; L3: import { createServer } from 'node:http'; L4: import { mkdir, readFile, writeFile } from 'node:fs/promises'; ... L9: export async function recordVisualVideo({ projectDir, plan, output, fps = 30 }) { L10: if (process.env.YUANFLOW_VIDEO_RECORDER_DISABLE === '1') { L11: throw new Error('puppeteer-recorder-disabled');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/video/recorder.jsView on unpkg · L1

lib/skill-installer/agents.cjsView file

24Install-time code directly mutates a foreign AI-agent control surface: L46: const configHome = getConfigHome(homeDir, env); L47: const codexHome = (env.CODEX_HOME || '').trim() || joinTargetPath(homeDir, '.codex'); L48: const claudeHome = (env.CLAUDE_CONFIG_DIR || '').trim() || joinTargetPath(homeDir, '.claude'); L49: ... L53: displayName: 'Codex', L54: projectSkillsDir: '.agents/skills', L55: globalSkillsDir: joinTargetPath(codexHome, 'skills'), ... L60: displayName: 'Claude Code', L61: projectSkillsDir: '.claude/skills', L62: globalSkillsDir: joinTargetPath(claudeHome, 'skills'), ... L67: displayName: 'Cursor', L68: projectSkillsDir: '.agents/skills', Write operation from lib/sk[redacted]/installer.cjs: L24: function ensureDir(targetDir) { L25: fs.mkdirSync(targetDir, { recursive: true

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/skill-installer/agents.cjsView on unpkg · L24

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView file

•path = skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.py kind = build_helper sizeBytes = 459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView on unpkg

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView file

•path = skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.py kind = payload_in_excluded_dir sizeBytes = 8030 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "yuanflow-cli",

3 "version": "0.1.87",

4 "description": "YuanFlow 自媒体 API CLI 与 Skill 安装器。",

5 "type": "module",

6 "license": "MIT",

7 "private": false,

8 "author": "zktlove",

9 "publishConfig": {

10 "access": "public"

11 },

12 "bin": {

13 "yuanflow-cli": "bin/yuanflow-cli.js",

14 "yuanflow-skill": "bin/yuanflow-skill.cjs"

15 },

16 "scripts": {

17 "postinstall": "node ./bin/yuanflow-skill.cjs install --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "generate": "node ./scripts/generate-registry.js",

19 "start": "node ./bin/yuanflow-cli.js",

20 "test": "node --test test/*.test.js tests/*.test.cjs",

21 "pack:check": "npm pack --dry-run",

22 "release:check": "node ./bin/yuanflow-skill.cjs release-check",

23 "publish:help": "node ./bin/yuanflow-skill.cjs publish-help"

24 },

25 "files": [

26 "bin",

27 "src",

28 "generated",

29 "scripts",

30 "lib",

31 "skills",

32 "README.md",

33 "LICENSE"

34 ],

35 "repository": {

36 "type": "git",

37 "url": "git+https://github.com/zktlove/yuanflow-cli.git"

bin/yuanflow-skill.cjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2

3const fs = require('node:fs');

4const path = require('node:path');

5const {

src/video/doctor.jsView file

Lines 98-138javascript

98 const metadataText = await metadataResponse.text();

99 const metadata = parseMaybeJson(metadataText);

100 if (!metadataResponse.ok) {

src/video/recorder.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

3import { createServer } from 'node:http';

4import { mkdir, readFile, writeFile } from 'node:fs/promises';

lib/skill-installer/agents.cjsView file

Lines 4-44javascript

4

5const SUPPORTED_AGENTS = [

6 'codex',

7 'claude-code',

8 'cursor',

9 'trae',

10 'opencode'

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView file

•path = skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.py kind = build_helper sizeBytes = 459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView on unpkg

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView file

•path = skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.py kind = payload_in_excluded_dir sizeBytes = 8030 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView on unpkg