Loading npm security reports…

@lingjingai/scriptctl@0.61.3: AI-agent control-surface risk | LPM Firewall

registry / @lingjingai/scriptctl / 0.61.3

@lingjingai/scriptctl@0.61.3

剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes three AI-agent skill control surfaces in the user's home directory. It removes and replaces the scriptctl skill directory in each location.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, which runs postinstall automatically

Impact

The package installs package-controlled instructions into Claude, generic-agent, and Codex skill locations without an explicit setup command.

Mechanism

automatic deletion and replacement of AI-agent skill directories

Policy narrative

A normal npm install invokes the postinstall hook. That hook resolves the user's home directory, iterates over three agent skill roots, forcibly removes each existing scriptctl skill directory, copies package-provided skill content there, and writes a version marker. This is an unconsented install-time mutation of broad AI-agent control surfaces.

AI rationale

The package has a concrete automatic postinstall chain that overwrites skill content in Claude, agent, and Codex directories. Opt-out support does not establish consent for the default mutation.

Evidence

package.jsonscripts/install-skill.mjsskills/scriptctl$HOME/.claude/skills/scriptctl$HOME/.agents/skills/scriptctl$HOME/.codex/skills/scriptctl

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/llm/gemini-video-model.jsView file

314// actually exercised (keeps text-only runs free of @google/genai). L315: const require = createRequire(import.meta.url); L316: function createGoogleClient(apiKey, timeoutMs, baseUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/llm/gemini-video-model.jsView on unpkg · L314

scripts/install-skill.mjsView file

22const TARGET_SKILL_ROOTS = [ L23: path.join(".claude", "skills"), L24: path.join(".agents", "skills"), L25: path.join(".codex", "skills"), L26: ]; ... L58: const stamped = text.replace(/^(\s+)scriptctl_version:.*$/m, `$1scriptctl_version: "${version}"`); L59: fs.writeFileSync(skillMdPath, stamped, "utf-8"); L60: } catch { ... L67: fs.rmSync(target, { recursive: true, force: true }); L68: fs.mkdirSync(path.dirname(target), { recursive: true }); L69: fs.cpSync(skillSrc, target, { recursive: true }); L70: stampVersion(path.join(target, "SKILL.md"), version);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L22

dist/usecases/ingest/view-server.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.57.1 matchedPath = dist/usecases/ingest/view-server.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.57.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usecases/ingest/view-server.jsView on unpkg

dist/bin.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/scriptctl@0.58.0 matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.58.0 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 4-44json

4 "description": "剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。",

5 "type": "module",

6 "bin": {

7 "scriptctl": "./dist/bin.js"

8 },

9 "main": "./dist/cli.js",

10 "types": "./dist/cli.d.ts",

11 "files": [

12 "dist",

13 "changes",

14 "skills",

15 "scripts/install-skill.mjs",

16 "README.md"

17 ],

18 "engines": {

19 "node": ">=20"

20 },

21 "scripts": {

22 "build": "pnpm --filter @lingjingai/screenplay build && pnpm --filter @lingjingai/review-agent build && tsc && node scripts/bundle.mjs",

23 "clean": "rm -rf dist packages/screenplay/dist",

24 "postinstall": "node scripts/install-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "install-skill": "node scripts/install-skill.mjs",

26 "prepublishOnly": "pnpm run clean && pnpm run build",

27 "pretest": "pnpm run build",

28 "test": "vitest run",

29 "pretest:coverage": "pnpm run build",

30 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov --report-dir=coverage vitest run",

31 "test:watch": "vitest",

32 "typecheck": "tsc --noEmit",

33 "surface:snapshot": "node scripts/scriptctl-surface-snapshot.mjs"

34 },

35 "dependencies": {

36 "@anthropic-ai/sdk": "^0.111.0",

37 "@google/genai": "^2.11.0",

38 "commander": "^12.1.0",

39 "fast-json-patch": "^3.1.1",

40 "fast-xml-parser": "^5.9.0",

41 "https-proxy-agent": "^9.1.0",

42 "jszip": "^3.10.1",

43 "nanoid": "^5.1.16",

44 "proper-lockfile": "^4.1.2",

dist/infra/llm/gemini-video-model.jsView file

314// actually exercised (keeps text-only runs free of @google/genai). L315: const require = createRequire(import.meta.url); L316: function createGoogleClient(apiKey, timeoutMs, baseUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/llm/gemini-video-model.jsView on unpkg · L314

scripts/install-skill.mjsView file

Lines 2-42javascript

2// postinstall: 把打包进 npm 包的 scriptctl skill 装到用户根目录下的三处 skill 目录

3// （Claude Code / agents / codex），并把「本次安装对应的 scriptctl 版本号」戳进每份

4// SKILL.md 的 frontmatter + 一个 .scriptctl-version 标记文件里。

5//

6// 设计要点：

7// - 永不让安装失败：全程 try/catch，任何异常只打印警告并以 0 退出（skill 装不上不该

8// 拖垮 `npm i -g scriptctl` 本身）。

9// - 开发态跳过：源码检出（存在 src/）不是「已发布的包」，跳过，免得 dev `pnpm install`

10// 覆盖你本地手改的 skill。

11// - 可关闭：SCRIPTCTL_SKIP_SKILL_INSTALL=1 或 SCRIPTCTL_SKILL_INSTALL=0。

dist/usecases/ingest/view-server.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.57.1 matchedPath = dist/usecases/ingest/view-server.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.57.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usecases/ingest/view-server.jsView on unpkg

dist/bin.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/scriptctl@0.58.0 matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.58.0 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg