registry / @lingjingai/scriptctl / 0.63.10
@lingjingai/scriptctl@0.63.10
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe source confirms automatic setup of this package's own agent skill under three user-level skill roots, so this warrants a warning for agent extension lifecycle risk. The inspected source did not establish a concrete malicious attack or broader agent configuration mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its postinstall hook unless an opt-out environment variable is set.
Impact
The installed skill becomes available to those agent environments; the change is limited to the package-named skill directory.
Mechanism
The script removes and recopies the package's scriptctl skill directory under each configured user skill root.
AI rationale
The source confirms automatic setup of this package's own agent skill under three user-level skill roots, so this warrants a warning for agent extension lifecycle risk. The inspected source did not establish a concrete malicious attack or broader agent configuration mutation.
Evidence
package.jsonscripts/install-skill.mjs~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install-skill.mjs automatically from postinstall.
- The installer replaces a package-named skill directory under the user's Claude, agents, and Codex skill roots.
- The installer has environment-variable opt-outs, but otherwise runs the installation loop for all listed roots.
Evidence against
- The installer copies only the package's own scriptctl skill into its named subdirectory.
- The inspected viewer binds to 127.0.0.1; the dynamic require loads the Google SDK when its video route is exercised.
- No concrete credential theft, remote payload execution, or broader agent configuration mutation was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/infra/llm/gemini-video-model.jsView file
•matchType = normalized_sha256
matchedPackage = @lingjingai/scriptctl@0.63.0
matchedPath = dist/infra/llm/gemini-video-model.js
matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.63.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/infra/llm/gemini-video-model.jsView on unpkg332// actually exercised (keeps text-only runs free of @google/genai).
L333: const require = createRequire(import.meta.url);
L334: function createGoogleClient(apiKey, timeoutMs, baseUrl) {
Findings
1 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/bin.js
HighKnown Malware Source Similaritydist/infra/llm/gemini-video-model.js
HighKnown Malware Source Similaritydist/usecases/ingest/view-server.js
HighKnown Malware Source Similaritydist/review-agent.js
HighPrevious Version Dangerous Deltadist/bin.js
MediumDynamic Requiredist/infra/llm/gemini-video-model.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.63.10.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.63.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.