registry / AI-agent control-surface risk / yunku-cli
yunku-cli
Yunku CLI - AI-powered productivity tools
This report shows the evidence for yunku-cli@1.0.1, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aipostinstall unconditionally installs skills into a wide set of home AI-agent directories, which is unconsented mutation of a foreign and broad agent control surface. The JavaScript shows no separate exfiltration step, but the install-time skill writes are enough to block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install lifecycle postinstall executes node install.js.
Impact
Install mutates foreign and broad AI-agent skill control surfaces under the user home without a separate consent step, so those agents can load the packaged ykc skills.
Mechanism
install.js extracts assets/ykc-skills.zip and copies those files into os.homedir() joined with each AGENT_DIRS entry plus ykc, removing any previous ykc folder first.
Policy narrative
Installing yunku-cli runs postinstall, which calls install.js. That script unpacks the platform binary into vendor and expands the skills zip, then copies the skill tree into the user home. It always writes ~/.agents/skills/ykc and, when the parent folder already exists, also writes a ykc skill folder for Claude, Cursor, Gemini, Codex, GitHub, Windsurf, and several other agents, replacing any previous ykc directory. This is an install-time write into foreign agent control surfaces.
AI rationale
postinstall unconditionally installs skills into a wide set of home AI-agent directories, which is unconsented mutation of a foreign and broad agent control surface. The JavaScript shows no separate exfiltration step, but the install-time skill writes are enough to block.
Evidence
package.jsoninstall.js.agents/skills/ykc.claude/skills/ykc.cursor/skills/ykc.gemini/skills/ykc.codex/skills/ykc.github/skills/ykc.windsurf/skills/ykc.augment/skills/ykc.cline/skills/ykc.amp/skills/ykc.kiro/skills/ykc.trae/skills/ykc.openclaw/skills/ykc
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 86.0% confidence with low false-positive risk.
Evidence for policy risk
- npm postinstall runs node install.js with no user flag.
- install.js copies bundled skills into many home AI-agent skill directories, including Claude, Cursor, Gemini, Codex, and others.
- The .agents/skills path is written on every install; other agent paths are written when that agent's parent directory already exists, after deleting any existing ykc skill folder.
- The same postinstall unpacks a platform binary into the package vendor directory and expands assets/ykc-skills.zip before the home copy.
Evidence against
- The JavaScript has no HTTP client, credential read, eval, or self-dependency.
- README.md states that the package installs the ykc executable and local agent skills.
- The skill zip and platform archives are binary and their internal contents were not decoded.
Behavioral surface
ChildProcessFilesystem
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg25"scripts": {
"postinstall": "node install.js"
},
High
Suspicious Lifecycle Evidence
npm postinstall runs node install.js with no user flag.
package.jsonView on unpkg · L25•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall.jsView file
11const AGENT_DIRS = [
L12: ".agents/skills",
L13: ".claude/skills",
L14: ".cursor/skills",
L15: ".gemini/skills",
L16: ".codex/skills",
L17: ".github/skills",
...
L41: fs.rmSync(dir, { recursive: true, force: true });
L42: fs.mkdirSync(dir, { recursive: true });
L43: }
...
L86: const targetPath = path.join(destDir, targetName);
L87: fs.copyFileSync(binaryPath, targetPath);
Findings
1 Critical5 High3 Medium3 Low
CriticalAi Agent Control Hijackinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobassets/ykc-darwin-amd64.tar.gz
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceinstall.js
HighAi Review Evidenceinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Compressed Blobassets/ykc-darwin-amd64.tar.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNested Archive Needs Inspectionassets/ykc-windows-amd64.zip
Affected versions and remediation
This report applies to yunku-cli@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing yunku-cli@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.