registry / @aswless_854771076/ai_short_studio_cli / 0.1.85
@aswless_854771076/ai_short_studio_cli@0.1.85
VVICAT 无限画布项目命令行工具
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe lifecycle hook makes a real agent configuration change, but source inspection shows it installs bundled first-party skills and avoids overwriting unmanaged or modified targets by default. The reviewed OAuth and updater code did not reveal unrelated credential forwarding or a malicious update chain.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm package installation, unless VVICAT_SKIP_SKILL_INSTALL is set or installation occurs from the package root.
Impact
Adds package-owned skill instructions to the user's agent environment, enabling the intended CLI workflow.
Mechanism
The hook copies bundled skill files to the Codex skills directory and skips replacement of unmanaged or modified existing targets.
AI rationale
The lifecycle hook makes a real agent configuration change, but source inspection shows it installs bundled first-party skills and avoids overwriting unmanaged or modified targets by default. The reviewed OAuth and updater code did not reveal unrelated credential forwarding or a malicious update chain.
Evidence
package.jsonscripts/postinstall.mjsdist/skill/skill-manager.js~/.codex/skills/using-vvicat-ai-short-studio-cli
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs scripts/postinstall.mjs after installation.
- The postinstall hook automatically copies bundled skills into the user's Codex skills directory unless skipped by an environment setting.
- The copied content is a first-party CLI skill, and the installer preserves unmanaged or modified targets unless forced.
- Google sign-in uses the Supabase OAuth flow and a loopback callback; no unrelated credential recipient was identified.
- The CLI updater checks the package identity and installs a newer release globally only when the version comparison requires it.
Evidence against
- The install-time agent configuration change is limited to installing bundled, package-owned skills; it does not establish an unconsented foreign agent-control mutation or malicious payload behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/skill/skill-manager.jsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L12: export function defaultSkillsRoot(target) {
L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills');
L14: }
...
L41: const backup = `${target}.backup-${process.pid}`;
L42: await mkdir(dirname(target), { recursive: true });
L43: await rm(temporary, { recursive: true, force: true });
L44: await cp(bundledSkillPath(name), temporary, { recursive: true });
L45: await writeFile(join(temporary, MANIFEST), `${JSON.stringify({ packageVersion, checksum }, null, 2)}\n`, 'utf8');
Write operation from dist/skill/sk[redacted]:
L12: export function defaultSkillsRoot(target) {
L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills');
L14: }
...
L41: const backup = `${target}.backup-
Findings
1 Critical4 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/skill/skill-manager.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill/skill-manager.js
HighKnown Malware Source Similaritydist/auth/google-oauth.js
HighPrevious Version Dangerous Deltadist/preflight.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @aswless_854771076/ai_short_studio_cli@0.1.85.
See all versions of @aswless_854771076/ai_short_studio_cli for other recorded verdicts.
- Review the evidence and your use of @aswless_854771076/ai_short_studio_cli@0.1.85 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.