registry / @lingjingai/scriptctl / 0.41.0

@lingjingai/scriptctl@0.41.0

⚠ Under review

剧本阶段统一 CLI：直转外部素材到 script.json，以及当前最终剧本的读取、校验、原子编辑与批量 patch 精修。

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 146 file(s), 838 KB of source, external domains: 127.0.0.1, example.com

Source & flagged code

2 flagged

package.jsonView file

Lines 4-44json

4 "description": "剧本阶段统一 CLI：直转外部素材到 script.json，以及当前最终剧本的读取、校验、原子编辑与批量 patch 精修。",

5 "type": "module",

6 "bin": {

7 "scriptctl": "./dist/bin.js"

8 },

9 "main": "./dist/cli.js",

10 "types": "./dist/cli.d.ts",

11 "files": [

12 "dist",

13 "changes",

14 "skills",

15 "scripts/install-skill.mjs",

16 "README.md"

17 ],

18 "engines": {

19 "node": ">=20"

20 },

21 "scripts": {

22 "build": "tsc",

23 "clean": "rm -rf dist",

24 "postinstall": "node scripts/install-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "install-skill": "node scripts/install-skill.mjs",

26 "prepublishOnly": "pnpm run clean && pnpm run build",

27 "pretest": "pnpm run build",

28 "test": "vitest run",

29 "pretest:coverage": "pnpm run build",

30 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov --report-dir=coverage vitest run",

31 "test:watch": "vitest",

32 "typecheck": "tsc --noEmit",

33 "surface:snapshot": "node scripts/scriptctl-surface-snapshot.mjs"

34 },

35 "dependencies": {

36 "@anthropic-ai/sdk": "^0.111.0",

37 "@google/genai": "^2.11.0",

38 "commander": "^12.1.0",

39 "fast-json-patch": "^3.1.1",

40 "fast-xml-parser": "^5.9.0",

41 "https-proxy-agent": "^9.1.0",

42 "jszip": "^3.10.1",

43 "pdfjs-dist": "^4.10.38",

44 "yaml": "^2.8.1"

scripts/install-skill.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// postinstall: 把打包进 npm 包的 scriptctl skill 装到用户根目录下的三处 skill 目录

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.mjsView on unpkg · L1

3// （Claude Code / agents / codex），并把「本次安装对应的 scriptctl 版本号」戳进每份

4// SKILL.md 的 frontmatter + 一个 .scriptctl-version 标记文件里。

5//

6// 设计要点：

7// - 永不让安装失败：全程 try/catch，任何异常只打印警告并以 0 退出（skill 装不上不该

8// 拖垮 `npm i -g scriptctl` 本身）。

Source & flagged code

2 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code