registry / AI-agent control-surface risk / @lingjingai/scriptctl
@lingjingai/scriptctl
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
This report shows the evidence for @lingjingai/scriptctl@0.63.0. 10 of 64 known versions are blocked or flagged. The newest version, 0.66.18, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe postinstall hook performs automatic, destructive replacement across three foreign AI-agent skill roots. Opt-out support and a narrow subdirectory name do not establish prior user consent for this lifecycle mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm postinstall during package installation
Impact
Changes the behavior and capabilities presented to Claude, generic agent, and Codex environments without an explicit setup command.
Mechanism
Automatic replacement of cross-agent skill directories
Policy narrative
The package executes scripts/install-skill.mjs automatically on installation. It resolves the user's home directory, deletes any existing scriptctl skill subdirectory, and copies its own skill into Claude, agents, and Codex skill roots. This is an unconsented install-time mutation of broad AI-agent control surfaces, allowing the package to seed instructions that enable direct local screenplay modifications.
AI rationale
The postinstall hook performs automatic, destructive replacement across three foreign AI-agent skill roots. Opt-out support and a narrow subdirectory name do not establish prior user consent for this lifecycle mutation.
Evidence
package.jsonscripts/install-skill.mjsskills/scriptctl/SKILL.md.claude/skills/scriptctl.agents/skills/scriptctl.codex/skills/scriptctl
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The automatic postinstall hook runs an installer.
- The installer targets Claude, generic agent, and Codex skill directories under the user home directory.
- It force-removes and replaces each scriptctl skill directory during installation.
- The installed skill directs agents to run commands that can modify local screenplay files.
Evidence against
- The installer supports environment-variable opt-out and only writes a named subdirectory.
- No network request or credential collection occurs in the install script.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/infra/llm/gemini-video-model.jsView file
332// actually exercised (keeps text-only runs free of @google/genai).
L333: const require = createRequire(import.meta.url);
L334: function createGoogleClient(apiKey, timeoutMs, baseUrl) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/infra/llm/gemini-video-model.jsView on unpkg · L332scripts/install-skill.mjsView file
22const TARGET_SKILL_ROOTS = [
L23: path.join(".claude", "skills"),
L24: path.join(".agents", "skills"),
L25: path.join(".codex", "skills"),
L26: ];
...
L58: const stamped = text.replace(/^(\s+)scriptctl_version:.*$/m, `$1scriptctl_version: "${version}"`);
L59: fs.writeFileSync(skillMdPath, stamped, "utf-8");
L60: } catch {
...
L67: fs.rmSync(target, { recursive: true, force: true });
L68: fs.mkdirSync(path.dirname(target), { recursive: true });
L69: fs.cpSync(skillSrc, target, { recursive: true });
L70: stampVersion(path.join(target, "SKILL.md"), version);
Findings
1 Critical5 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/bin.js
HighKnown Malware Source Similaritydist/usecases/ingest/view-server.js
HighKnown Malware Source Similaritydist/review-agent.js
HighPrevious Version Dangerous Deltadist/bin.js
MediumDynamic Requiredist/infra/llm/gemini-video-model.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.63.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @lingjingai/scriptctl@0.63.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
64 known versions0.66.18latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 8:52 PM0.66.17SuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 6:43 PM0.66.14SuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 11:08 AM0.66.12SuspiciousAgent extension lifecycle riskWarnPublished