registry / @lingjingai/scriptctl / 0.63.19
@lingjingai/scriptctl@0.63.19
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe source confirms automatic, unprompted installation of a first-party agent skill during postinstall, with an environment-variable opt-out and replacement of existing same-name skill directories. This warrants a warning for agent extension lifecycle risk, but the inspected behavior does not establish a broader control-surface hijack or malicious attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation when the postinstall hook runs, unless the documented environment opt-out is set.
Impact
An existing scriptctl skill at those locations is overwritten, and the installed skill becomes available to those agents.
Mechanism
The installer removes and replaces the scriptctl subdirectory under three user-level agent skill roots with bundled package files.
AI rationale
The source confirms automatic, unprompted installation of a first-party agent skill during postinstall, with an environment-variable opt-out and replacement of existing same-name skill directories. This warrants a warning for agent extension lifecycle risk, but the inspected behavior does not establish a broader control-surface hijack or malicious attack.
Evidence
package.jsonscripts/install-skill.mjs~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install-skill.mjs during postinstall.
- The installer targets scriptctl skill directories under .claude, .agents, and .codex in the user home directory.
- The installer recursively removes an existing target directory before copying the bundled skill into it.
- Environment variables can opt out, but installation otherwise runs without a consent prompt.
Evidence against
- The mutation is limited to this package's own named skill subdirectory in the listed locations.
- The inspected installer copies bundled files locally; no network transfer or command execution is shown in this behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/review-agent.jsView file
30${u?"rewired":"cleared"} ${o.length} scene binding(s) and ${s.length} speaker(s)${u?` to ${ze(e,t.id,u)}`:""}`}let c=t.raw.states;return c.splice(c.findIndex(u=>u.state_id===r.id),...
L31: moved ${h.length} scene reference(s), ${g.length} speaker(s), ${[...l].filter(([p,f])=>p!==f).length} state mapping(s)`+K(e,s)}import{z as q}from"zod";var hs=["scene-reference","ac...
L32: ]))`;continue}else if(o[u]==="$"){s+=`($|(?=[\r
High
Child Process
Package source references child process execution.
dist/review-agent.jsView on unpkg · L3030${u?"rewired":"cleared"} ${o.length} scene binding(s) and ${s.length} speaker(s)${u?` to ${ze(e,t.id,u)}`:""}`}let c=t.raw.states;return c.splice(c.findIndex(u=>u.state_id===r.id),...
L31: moved ${h.length} scene reference(s), ${g.length} speaker(s), ${[...l].filter(([p,f])=>p!==f).length} state mapping(s)`+K(e,s)}import{z as q}from"zod";var hs=["scene-reference","ac...
L32: ]))`;continue}else if(o[u]==="$"){s+=`($|(?=[\r
Findings
1 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/review-agent.js
HighSame File Env Network Executiondist/review-agent.js
HighCommand Output Exfiltrationdist/review-agent.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-YOCQDDQC.js
HighObfuscated
MediumDynamic Requiredist/chunk-YOCQDDQC.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.63.19.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.63.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.