Loading npm security reports…
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall installs this package’s skill into Claude, agents, and Codex skill directories. It replaces only each scriptctl child directory; no malicious payload chain was confirmed.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/infra/llm/gemini-video-model.jsView on unpkgPackage source references dynamic require/import behavior.
dist/infra/llm/gemini-video-model.jsView on unpkg · L280Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skill.mjsView on unpkg · L22Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L24Package source references dynamic require/import behavior.
dist/infra/llm/gemini-video-model.jsView on unpkg · L280This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/infra/llm/gemini-video-model.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skill.mjsView on unpkg · L22