Loading npm security reports…
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs and overwrites an agent skill in three user-level AI-agent control surfaces. This changes Claude, generic agents, and Codex behavior without an explicit setup command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
dist/infra/llm/gemini-video-model.jsView on unpkg · L280Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skill.mjsView on unpkg · L22Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L24Package source references dynamic require/import behavior.
dist/infra/llm/gemini-video-model.jsView on unpkg · L280Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install-skill.mjsView on unpkg · L22