registry / @lingjingai/scriptctl / 0.63.17

@lingjingai/scriptctl@0.63.17

剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic postinstall installation and replacement of a first-party agent skill is a guarded agent extension lifecycle risk. Its limited target scope and opt-outs do not establish concrete malicious behavior, so warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through a package manager that runs postinstall, unless the documented environment opt-out is set.

Impact

The package can add or replace its own agent skill without an interactive consent prompt; the observed scope is limited to the scriptctl subdirectory.

Mechanism

The hook recursively removes each target scriptctl directory and copies the bundled skill into its place.

AI rationale

Evidence

package.jsonscripts/install-skill.mjs~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/install-skill.mjs automatically during postinstall.
The installer targets the user's Claude, Agents, and Codex skill directories.
The installer allows opt-out through SCRIPTCTL_SKIP_SKILL_INSTALL or SCRIPTCTL_SKILL_INSTALL.
For each target, it recursively removes the existing scriptctl skill directory and copies in the package's skill.
The installer skips source checkouts and installs the package-owned skill when its source exists.

Evidence against

The postinstall writes are limited to a named scriptctl subdirectory in each skill root; the source shows no unrelated agent configuration changes.
The flagged network and command execution patterns do not establish an attack here: the reviewed source shows provider requests and an updater command, without evidence of secret harvesting or covert exfiltration.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

Source & flagged code

6 flagged

package.jsonView file

Lines 8-48json

8 },

9 "main": "./dist/cli.js",

10 "types": "./dist/cli.d.ts",

11 "files": [

12 "dist/bin.js",

13 "dist/cli.js",

14 "dist/cli.d.ts",

15 "dist/review-agent.js",

16 "dist/chunk-*.js",

17 "changes",

18 "skills",

19 "scripts/install-skill.mjs",

20 "README.md"

21 ],

22 "engines": {

23 "node": ">=22.22.0"

24 },

25 "scripts": {

26 "build": "pnpm run clean && pnpm --filter @lingjingai/screenplay build && pnpm --filter @lingjingai/review-agent build && tsc && node scripts/bundle.mjs",

27 "clean": "rm -rf dist packages/screenplay/dist packages/review-agent/dist",

28 "postinstall": "node scripts/install-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

29 "install-skill": "node scripts/install-skill.mjs",

30 "prepublishOnly": "pnpm run build",

31 "pretest": "pnpm run build",

32 "test": "vitest run",

33 "pretest:coverage": "pnpm run build",

34 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov --report-dir=coverage vitest run",

35 "test:watch": "vitest",

36 "typecheck": "tsc --noEmit",

37 "surface:snapshot": "node scripts/scriptctl-surface-snapshot.mjs"

38 },

39 "dependencies": {

40 "@anthropic-ai/sdk": "^0.111.0",

41 "@google/genai": "^2.11.0",

42 "commander": "^12.1.0",

43 "fast-json-patch": "^3.1.1",

44 "fast-xml-parser": "^5.9.0",

45 "google-auth-library": "^10.9.0",

46 "https-proxy-agent": "^9.1.0",

47 "jszip": "^3.10.1",

48 "nanoid": "^5.1.16",

dist/chunk-YOCQDDQC.jsView file

150Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js -> dist/chunk-YOCQDDQC.js L150: L151: `);i&&(o.systemInstruction=i),t.responseJsonSchema&&!n&&(o.responseMimeType="application/json",o.responseJsonSchema=t.responseJsonSchema);let r={model:this.model.model,contents:[{r... L152: L153: \u53EA\u8FD4\u56DE JSON \u5BF9\u8C61\u672C\u8EAB\uFF0C\u4E0D\u8981\u8F93\u51FA\u4EFB\u4F55\u89E3\u91CA\u3001\u524D\u8A00\u3001Markdown \u4EE3\u7801\u5757\u6216\u5176\u4ED6\u6587\u5... L154: Gemini \u4E0A\u4F20\u4F1A\u6210\u529F\u3001\u968F\u540E\u7684\u6587\u4EF6\u8F6E\u8BE2/\u751F\u6210\u4F1A\u6302\uFF08Node \u5185\u7F6E fetch \u9ED8\u8BA4\u4E0D\u8D70\u4EE3\u7406\uFF... ... L156: `),{files:{upload:c=>ou({apiKey:e,filePath:c.file,mimeType:c.config?.mimeType??"video/mp4",timeout

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-YOCQDDQC.jsView on unpkg · L150

125`)} L126: `}function Be(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function ct(e,t){return e[t]===void 0||typeof e[t]=="string"}function Ca(e){return e===null||typeof e=="stri... L127: `)}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-YOCQDDQC.jsView on unpkg · L125

dist/review-agent.jsView file

Lines 10-50javascript

10`)}function qo(e,t,r){let n=`# EP${String(t.no).padStart(2,"0")} ${t.id} ${t.scenes.length} scenes`+(t.title?` ${t.title}`:"");return r.depth==="outline"?[n,...t.scenes.map(o=>We(e,o))].join(`

11`):[n,...t.scenes.map(o=>Kt(e,o,r))].join(`

13`)}function Xo(e,t){let r=t.raw.role_type?` <

scripts/install-skill.mjsView file

Lines 2-42javascript

2// postinstall: 把打包进 npm 包的 scriptctl skill 装到用户根目录下的三处 skill 目录

3// （Claude Code / agents / codex），并把「本次安装对应的 scriptctl 版本号」戳进每份

4// SKILL.md 的 frontmatter + 一个 .scriptctl-version 标记文件里。

5//

6// 设计要点：

7// - 永不让安装失败：全程 try/catch，任何异常只打印警告并以 0 退出（skill 装不上不该

8// 拖垮 `npm i -g scriptctl` 本身）。

9// - 开发态跳过：源码检出（存在 src/）不是「已发布的包」，跳过，免得 dev `pnpm install`

10// 覆盖你本地手改的 skill。

11// - 可关闭：SCRIPTCTL_SKIP_SKILL_INSTALL=1 或 SCRIPTCTL_SKILL_INSTALL=0。

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunk-YOCQDDQC.jsView file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-YOCQDDQC.jsView on unpkg · L150

Findings

1 Critical5 High4 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skill.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executiondist/review-agent.js

HighCommand Output Exfiltrationdist/review-agent.js

HighTrigger Reachable Command Output Exfiltrationdist/chunk-YOCQDDQC.js

HighObfuscated

MediumDynamic Requiredist/chunk-YOCQDDQC.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @lingjingai/scriptctl@0.63.17.

See all versions of @lingjingai/scriptctl for other recorded verdicts.

Review the evidence and your use of @lingjingai/scriptctl@0.63.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 07:09:10.846Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @lingjingai

Behavioral surface

Related packages

More from @lingjingai

Source & flagged code