registry / AI-agent control-surface risk / @aswless_854771076/ai_short_studio_cli

@aswless_854771076/ai_short_studio_cli

VVICAT 无限画布项目命令行工具

This report shows the evidence for @aswless_854771076/ai_short_studio_cli@0.1.47. 6 of 34 known versions are blocked or flagged. The newest version, 0.1.98, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source confirms unconsented install-time mutation of the broad Codex skill control surface. This meets the firewall block boundary regardless of the otherwise conventional CLI authentication and API behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation outside the package root

Impact

Unconsented persistence of package-provided instructions in a broad AI-agent control surface.

Mechanism

automatic postinstall installation of bundled Codex skills

Policy narrative

On installation, the postinstall script defaults to ~/.codex/skills and copies three bundled skills. The manager creates directories, replaces its previously managed targets, and writes a manifest. This silently injects package-controlled instructions into Codex's global skill discovery path rather than requiring an explicit user command.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/skill/skill-manager.jsskills/using-vvicat-ai-short-studio-cli/SKILL.mdskills/using-vvicat-ai-short-studio-cliskills/short-dramaskills/humanizer~/.codex/skills/using-vvicat-ai-short-studio-cli~/.codex/skills/short-drama~/.codex/skills/humanizer

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json defines postinstall.
scripts/postinstall.mjs automatically installs bundled skills unless opted out.
Default postinstall target is ~/.codex/skills.
dist/skill/skill-manager.js recursively copies and replaces three skill directories.
Installed skill directs agents to operate a remote VVICAT service and enables auto-update guidance.

Evidence against

Installer avoids replacing unmanaged or modified skill directories.
OAuth, credential storage, and API calls are CLI runtime features, not postinstall actions.
No postinstall network request or credential harvesting was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 102 KB of source, external domains: 127.0.0.1, ai-short-studio.vvicat.dev

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/skill/skill-manager.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';

3import { homedir } from 'node:os';

4import { basename, dirname, join, relative } from 'node:path';

5import { fileURLToPath } from 'node:url';

6export const BUNDLED_SKILL_NAMES = ['using-vvicat-ai-short-studio-cli', 'short-drama', 'humanizer'];

7const PACKAGE_JSON = fileURLToPath(new URL('../../package.json', import.meta.url));

8const MANIFEST = '.vvicat-skill.json';

9export function bundledSkillPath(name = BUNDLED_SKILL_NAMES[0]) {

10 return fileURLToPath(new URL(`../../skills/${name}`, import.meta.url));

11}

12export function defaultSkillsRoot(target) {

13 return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills');

14}

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/skill/skill-manager.jsView on unpkg · L1

15export function defaultSkillTarget(target) {

16 return join(defaultSkillsRoot(target), BUNDLED_SKILL_NAMES[0]);

17}

18export function normalizeSkillsRoot(path) {

19 return BUNDLED_SKILL_NAMES.includes(basename(path)) ? dirname(path) : path;

20}

21async function statusFor(name, target) {

dist/auth/google-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.46 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c131ebf5f25e1696 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.46 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.46 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

dist/preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.46 matchedPath = dist/preflight.js matchedIdentity = npm:[redacted]:0.1.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/preflight.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/skill/skill-manager.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L12: export function defaultSkillsRoot(target) { L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills'); L14: } ... L41: const backup = `${target}.backup-${process.pid}`; L42: await mkdir(dirname(target), { recursive: true }); L43: await rm(temporary, { recursive: true, force: true }); L44: await cp(bundledSkillPath(name), temporary, { recursive: true }); L45: await writeFile(join(temporary, MANIFEST), `${JSON.stringify({ packageVersion, checksum }, null, 2)}\n`, 'utf8'); Write operation from dist/skill/sk[redacted]: L12: export function defaultSkillsRoot(target) { L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills'); L14: } ... L41: const backup = `${target}.backup-

Findings

1 Critical4 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/skill/skill-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/auth/google-oauth.js

HighKnown Malware Source Similaritydist/preflight.js

HighKnown Malware Source Fingerprint Signaturedist/auth/google-oauth.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @aswless_854771076/ai_short_studio_cli@0.1.47.

The versions list below shows the verdict for each recorded version.

Avoid installing @aswless_854771076/ai_short_studio_cli@0.1.47. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 13:05:54.551Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

34 known versions

0.1.98latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 6:03 AM 0.1.97SuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 5:07 AM 0.1.95SuspiciousAgent extension lifecycle riskWarnPublishedOct 12, 2026, 3:47 AM 0.1.94SuspiciousAgent extension lifecycle riskWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code