registry / @lingjingai/scriptctl / 0.63.18
@lingjingai/scriptctl@0.63.18
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically replaces a same-named skill directory in user-level agent locations. This is first-party agent extension setup, which warrants a warning, but the inspected source does not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation runs the postinstall hook unless the supported opt-out variable is set.
Impact
The installation changes user-level agent skill configuration and can replace a pre-existing scriptctl skill directory. No confirmed credential theft or remote execution was established from the inspected setup code.
Mechanism
The hook removes each target directory and copies the bundled skill into it.
AI rationale
The postinstall hook automatically replaces a same-named skill directory in user-level agent locations. This is first-party agent extension setup, which warrants a warning, but the inspected source does not establish a concrete attack.
Evidence
package.jsonscripts/install-skill.mjs.claude/skills/scriptctl.agents/skills/scriptctl.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs scripts/install-skill.mjs from its postinstall hook.
- The hook targets scriptctl skill directories under the user's .claude, .agents, and .codex directories.
- Installation recursively removes the existing scriptctl target directory and copies the package's skill into its place.
- The hook supports opt-out environment variables.
Evidence against
- The postinstall behavior installs this package's own named skill; the inspected code does not show credential collection or a remote payload in this setup path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/review-agent.jsView file
30${d?"rewired":"cleared"} ${o.length} scene binding(s) and ${s.length} speaker(s)${d?` to ${Be(e,t.id,d)}`:""}`}let c=t.raw.states;return c.splice(c.findIndex(d=>d.state_id===r.id),...
L31: moved ${h.length} scene reference(s), ${g.length} speaker(s), ${[...l].filter(([f,p])=>f!==p).length} state mapping(s)`+H(e,s)}import{z as W}from"zod";var hs=["scene-reference","ac...
L32: ]))`;continue}else if(o[d]==="$"){s+=`($|(?=[\r
High
Child Process
Package source references child process execution.
dist/review-agent.jsView on unpkg · L3030${d?"rewired":"cleared"} ${o.length} scene binding(s) and ${s.length} speaker(s)${d?` to ${Be(e,t.id,d)}`:""}`}let c=t.raw.states;return c.splice(c.findIndex(d=>d.state_id===r.id),...
L31: moved ${h.length} scene reference(s), ${g.length} speaker(s), ${[...l].filter(([f,p])=>f!==p).length} state mapping(s)`+H(e,s)}import{z as W}from"zod";var hs=["scene-reference","ac...
L32: ]))`;continue}else if(o[d]==="$"){s+=`($|(?=[\r
Findings
1 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/review-agent.js
HighSame File Env Network Executiondist/review-agent.js
HighCommand Output Exfiltrationdist/review-agent.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-YOCQDDQC.js
HighObfuscated
MediumDynamic Requiredist/chunk-YOCQDDQC.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.63.18.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.63.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.