Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@aswless_854771076/ai_short_studio_cli@0.1.37: Suspicious npm | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / @aswless_854771076/ai_short_studio_cli / 0.1.37

@aswless_854771076/ai_short_studio_cli@0.1.37

VVICAT 无限画布项目命令行工具

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall mutates the user's Codex skill directory without an explicit command. It installs two bundled VVICAT-owned skills and may update targets previously marked as package-managed.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall, unless VVICAT_SKIP_SKILL_INSTALL=1 or installation is in the package root

Impact

Adds agent instructions and remote-service operating capability to the user's Codex environment.

Mechanism

automatic first-party Codex skill deployment

Rationale

This is an unconsented install-time mutation of an AI-agent extension surface, warranting a warning. It is a guarded first-party skill deployment rather than a concrete malicious chain, so blocking is not justified.

Evidence

package.jsonscripts/postinstall.mjsdist/skill/skill-manager.jsskills/using-vvicat-ai-short-studio-cli/SKILL.mddist/runtime.jsskills/using-vvicat-ai-short-studio-cliskills/short-drama~/.codex/skills/using-vvicat-ai-short-studio-cli~/.codex/skills/short-drama

Network endpoints1

ai-short-studio.vvicat.dev

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Suspicious at 94.0% confidence as Benign with low false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.mjs on install.
scripts/postinstall.mjs auto-installs bundled skills by default.
dist/skill/skill-manager.js writes into ~/.codex/skills and replaces package-managed targets.
Installed skill gives agents operational access to the VVICAT CLI and its remote API.

Evidence against

The installer copies only bundled local skill files; no install-time network call or payload download.
Existing unmanaged or modified skill directories are skipped unless forced.
Skill content directs user-confirmed operations and cautions against placing credentials in logs.
Network use is CLI functionality targeting the configured VVICAT service.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 83.8 KB of source, external domains: 127.0.0.1, ai-short-studio.vvicat.dev

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/skill/skill-manager.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L12: export function defaultSkillsRoot(target) { L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills'); L14: } ... L41: const backup = `${target}.backup-${process.pid}`; L42: await mkdir(dirname(target), { recursive: true }); L43: await rm(temporary, { recursive: true, force: true }); L44: await cp(bundledSkillPath(name), temporary, { recursive: true }); L45: await writeFile(join(temporary, MANIFEST), `${JSON.stringify({ packageVersion, checksum }, null, 2)}\n`, 'utf8'); Write operation from dist/skill/sk[redacted]: L12: export function defaultSkillsRoot(target) { L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills'); L14: } ... L41: const backup = `${target}.backup-

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/skill/skill-manager.jsView on unpkg · L1

Findings

1 Critical1 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/skill/skill-manager.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

94%Warn

Verdict confidence

IntentBenign

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainersaswless_854771076

Version0.1.50

PublishedAug 6, 2026

LicenseMIT

Dependencies3

Integrityverified

Package size110 KB

Files144

LinksRepository Homepage

Runtime surface

package.json

Entrypointsbin → ai-short-studio

Runtimenode >=22

Artifact337 KB · 144 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

3 flagged

package.jsonView file

Lines 12-52json

12 "homepage": "https://codeup.aliyun.com/685a53a7323b2da0bd60070e/vvicat-ai-short-studio",

13 "publishConfig": {

14 "access": "public"

15 },

16 "type": "module",

17 "bin": {

18 "ai-short-studio": "bin/run.js"

19 },

20 "files": [

21 "bin",

22 "dist",

23 "skills",

24 "scripts/postinstall.mjs",

25 "README.md"

26 ],

27 "engines": {

28 "node": ">=22"

29 },

30 "scripts": {

31 "build": "node scripts/clean.mjs && tsc -p tsconfig.json",

32 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "prepack": "npm run build",

34 "release:dry-run": "node scripts/publish.mjs --dry-run",

35 "release:test": "node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta",

36 "release:ci:test": "npm test && npm run typecheck && node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta --verify",

37 "release:ci": "npm test && npm run typecheck && node scripts/publish.mjs --tag latest --verify",

38 "release": "node scripts/publish.mjs --tag latest",

39 "test": "vitest run",

40 "typecheck": "tsc -p tsconfig.json --noEmit"

41 },

42 "dependencies": {

43 "@napi-rs/keyring": "^1.3.0",

44 "@oclif/core": "^4.12.0",

45 "@supabase/supabase-js": "^2.110.7"

46 },

47 "devDependencies": {

48 "@types/node": "^20.19.43",

49 "typescript": "^5.9.3",

50 "vitest": "^2.1.9"

51 },

52 "oclif": {

dist/skill/skill-manager.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';

3import { homedir } from 'node:os';

4import { basename, dirname, join, relative } from 'node:path'

;

5import { fileURLToPath } from 'node:url';

6export const BUNDLED_SKILL_NAMES = ['using-vvicat-ai-short-studio-cli', 'short-drama'];

7const PACKAGE_JSON = fileURLToPath(new URL('../../package.json', import.meta.url));

8const MANIFEST = '.vvicat-skill.json';

9export function bundledSkillPath(name = BUNDLED_SKILL_NAMES[0]) {

10 return fileURLToPath(new URL(`../../skills/${name}`, import.meta.url));

11}

12export function defaultSkillsRoot(target) {

13 return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills');

14}

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/skill/skill-manager.jsView on unpkg · L1

15export function defaultSkillTarget(target) {

16 return join(defaultSkillsRoot(target), BUNDLED_SKILL_NAMES[0]);

17}

18export function normalizeSkillsRoot(path) {

19 return BUNDLED_SKILL_NAMES.includes(basename(path)) ? dirname(path) : path;

20}

21async function statusFor(name, target) {