Loading npm security reports…

yunku-cli@1.0.1: AI-agent control-surface risk | LPM Firewall

registry / yunku-cli / 1.0.1

yunku-cli@1.0.1

Yunku CLI - AI-powered productivity tools

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall runs install.js, which unpacks a bundled binary and writes the bundled ykc skill tree into the user home across many AI-agent skill directories. The .agents path is always created; other agents are updated when their home directory already exists.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install lifecycle postinstall executes node install.js.

Impact

Install mutates foreign and broad AI-agent skill control surfaces under the user home without a separate consent step, so those agents can load the packaged ykc skills.

Mechanism

install.js extracts assets/ykc-skills.zip and copies those files into os.homedir() joined with each AGENT_DIRS entry plus ykc, removing any previous ykc folder first.

Policy narrative

Installing yunku-cli runs postinstall, which calls install.js. That script unpacks the platform binary into vendor and expands the skills zip, then copies the skill tree into the user home. It always writes ~/.agents/skills/ykc and, when the parent folder already exists, also writes a ykc skill folder for Claude, Cursor, Gemini, Codex, GitHub, Windsurf, and several other agents, replacing any previous ykc directory. This is an install-time write into foreign agent control surfaces.

AI rationale

postinstall unconditionally installs skills into a wide set of home AI-agent directories, which is unconsented mutation of a foreign and broad agent control surface. The JavaScript shows no separate exfiltration step, but the install-time skill writes are enough to block.

Evidence

package.jsoninstall.js.agents/skills/ykc.claude/skills/ykc.cursor/skills/ykc.gemini/skills/ykc

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

25"scripts": { "postinstall": "node install.js" },

High

Suspicious Lifecycle Evidence

npm postinstall runs node install.js with no user flag.

package.jsonView on unpkg · L25

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

11const AGENT_DIRS = [ L12: ".agents/skills", L13: ".claude/skills", L14: ".cursor/skills", L15: ".gemini/skills", L16: ".codex/skills", L17: ".github/skills", ... L41: fs.rmSync(dir, { recursive: true, force: true }); L42: fs.mkdirSync(dir, { recursive: true }); L43: } ... L86: const targetPath = path.join(destDir, targetName); L87: fs.copyFileSync(binaryPath, targetPath);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L11

11const AGENT_DIRS = [ ".agents/skills", ".claude/skills", ".cursor/skills", ".gemini/skills", ".codex/skills", ".github/skills", ".windsurf/skills", ".augment/skills", ".cline/skills", ".amp/skills", ".kiro/skills", ".trae/skills", ".openclaw/skills", ];

High

Ai Review Evidence

install.js copies bundled skills into many home AI-agent skill directories, including Claude, Cursor, Gemini, Codex, and others.

install.jsView on unpkg · L11

117function installSkillsToHomes(skillRoot) { const homeDir = os.homedir(); let installed = 0; AGENT_DIRS.forEach((agentDir, index) => { const baseDir = path.join(homeDir, agentDir); const parentGate = path.dirname(baseDir); if (index > 0 && !fs.existsSync(parentGate)) { return; } const destDir = path.join(baseDir, "ykc"); fs.rmSync(destDir, { recursive: true, force: true }); copyChildren(skillRoot, destDir); installed += 1; });

High

Ai Review Evidence

The .agents/skills path is written on every install; other agent paths are written when that agent's parent directory already exists, after deleting any existing ykc skill folder.

install.jsView on unpkg · L117

assets/ykc-darwin-amd64.tar.gzView file

•path = assets/ykc-darwin-amd64.tar.gz kind = high_entropy_blob sizeBytes = 4230089 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/ykc-darwin-amd64.tar.gzView on unpkg

•path = assets/ykc-darwin-amd64.tar.gz kind = compressed_blob sizeBytes = 4230089 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/ykc-darwin-amd64.tar.gzView on unpkg

assets/ykc-windows-amd64.zipView file

•path = assets/ykc-windows-amd64.zip kind = nested_archive_needs_inspection sizeBytes = 4307467 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/ykc-windows-amd64.zipView on unpkg