registry / @lingjingai/scriptctl / 0.63.11
@lingjingai/scriptctl@0.63.11
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook performs automatic first-party skill setup in user-level AI-agent directories and replaces the existing scriptctl skill there. This warrants a warning as an agent extension lifecycle risk; the inspected code does not establish a concrete malicious attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through a flow that runs its postinstall hook, unless the installer opt-out is set.
Impact
The installed skill becomes available to those agent environments and any existing scriptctl skill contents in those locations are replaced.
Mechanism
The installer deletes and recursively recopies the scriptctl skill directory under the user's Claude, agents, and Codex skill roots.
AI rationale
The postinstall hook performs automatic first-party skill setup in user-level AI-agent directories and replaces the existing scriptctl skill there. This warrants a warning as an agent extension lifecycle risk; the inspected code does not establish a concrete malicious attack.
Evidence
package.jsonscripts/install-skill.mjs~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically runs the skill installer.
- The installer targets the user's Claude, agents, and Codex skill directories.
- It recursively removes each existing package-owned skill directory, then copies the bundled skill into its place.
- The script supports opt-out flags, but installation proceeds by default.
Evidence against
- The installer replaces only the scriptctl subdirectory in each listed skill directory.
- The bundled skill describes local scriptctl workflows; no remote endpoint is established by the inspected installation code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/infra/llm/gemini-video-model.jsView file
•matchType = normalized_sha256
matchedPackage = @lingjingai/scriptctl@0.63.0
matchedPath = dist/infra/llm/gemini-video-model.js
matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.63.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/infra/llm/gemini-video-model.jsView on unpkg332// actually exercised (keeps text-only runs free of @google/genai).
L333: const require = createRequire(import.meta.url);
L334: function createGoogleClient(apiKey, timeoutMs, baseUrl) {
Findings
1 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/bin.js
HighKnown Malware Source Similaritydist/infra/llm/gemini-video-model.js
HighKnown Malware Source Similaritydist/usecases/ingest/view-server.js
HighKnown Malware Source Similaritydist/review-agent.js
HighPrevious Version Dangerous Deltadist/bin.js
MediumDynamic Requiredist/infra/llm/gemini-video-model.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.63.11.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.63.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.