registry / @aswless_854771076/ai_short_studio_cli / 0.1.98

@aswless_854771076/ai_short_studio_cli@0.1.98

VVICAT 无限画布项目命令行工具

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The source confirms automatic postinstall setup of a first-party agent skill in a global Codex configuration location, with an opt-out but no affirmative consent gate. This warrants a warning for agent extension lifecycle risk; the inspected source does not establish a concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the npm package when the opt-out variable is unset and the install is not running from the package itself.

Impact

The agent gains a package-provided skill that directs it to operate the VVICAT CLI; no credential transfer or remote skill channel was identified in the inspected source.

Mechanism

The hook imports the skill manager and installs the bundled skill under the user's .codex/skills directory, while skipping existing unmanaged or modified targets.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/skill/skill-manager.jsskills/using-vvicat-ai-short-studio-cli/SKILL.md~/.codex/skills/using-vvicat-ai-short-studio-cli

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines a postinstall hook that runs scripts/postinstall.mjs.
The hook skips only when an opt-out variable is set or installation runs from the package itself; otherwise it calls automatic skill installation.
The default installation destination is the user's .codex/skills directory, and the manager copies the bundled skill there.
The bundled skill directs an AI agent to use this CLI for VVICAT project work.
Automatic installation skips an existing skill if it is unmanaged or modified.

Evidence against

The bundled skill describes product workflows and safeguards; inspected content showed no review-directed override or remote skill channel.
The manager avoids replacing existing unmanaged or modified skill directories.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

5 flagged

package.jsonView file

Lines 12-52json

12 "homepage": "https://codeup.aliyun.com/685a53a7323b2da0bd60070e/vvicat-ai-short-studio",

13 "publishConfig": {

14 "access": "public"

15 },

16 "type": "module",

17 "bin": {

18 "ai-short-studio": "bin/run.js"

19 },

20 "files": [

21 "bin",

22 "dist",

23 "skills",

24 "scripts/postinstall.mjs",

25 "README.md"

26 ],

27 "engines": {

28 "node": ">=22"

29 },

30 "scripts": {

31 "build": "node scripts/clean.mjs && tsc -p tsconfig.json",

32 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "prepack": "npm run build",

34 "release:dry-run": "node scripts/publish.mjs --dry-run",

35 "release:test": "node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta",

Medium

Suspicious Lifecycle Evidence

package.json defines a postinstall hook that runs scripts/postinstall.mjs.

package.jsonView on unpkg · L32

36 "release:ci:test": "npm test && npm run typecheck && node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta --verify && node scripts/smoke-remote.mjs",

37 "release:ci": "npm test && npm run typecheck && node scripts/publish.mjs --tag latest --verify && node scripts/smoke-remote.mjs",

38 "release": "node scripts/publish.mjs --tag latest",

39 "test": "vitest run",

40 "test:local-e2e": "npm run build && node scripts/local-e2e.mjs",

41 "test:smoke": "node scripts/smoke-remote.mjs",

42 "typecheck": "tsc -p tsconfig.json --noEmit"

43 },

44 "dependencies": {

45 "@napi-rs/keyring": "^1.3.0",

46 "@oclif/core": "^4.12.0",

47 "@supabase/supabase-js": "^2.110.7"

48 },

49 "devDependencies": {

50 "@types/node": "^20.19.43",

51 "typescript": "^5.9.3",

52 "vitest": "^2.1.9"

dist/skill/skill-manager.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { cp, lstat, mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';

3import { homedir } from 'node:os';

4import { basename, dirname, join, relative } from 'node:path'

dist/auth/google-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.47 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.47 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

32"postinstall": "node scripts/postinstall.mjs", "prepack": "npm run build", "release:dry-run": "node scripts/publish.mjs --dry-run", "release:test": "node scripts/publis

Medium

Suspicious Lifecycle Evidence

package.json defines a postinstall hook that runs scripts/postinstall.mjs.

package.jsonView on unpkg · L32

dist/skill/skill-manager.jsView file

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackdist/skill/skill-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/auth/google-oauth.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @aswless_854771076/ai_short_studio_cli@0.1.98.

See all versions of @aswless_854771076/ai_short_studio_cli for other recorded verdicts.

Review the evidence and your use of @aswless_854771076/ai_short_studio_cli@0.1.98 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 06:06:29.763Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.