registry / @lingjingai/scriptctl / 0.65.3
@lingjingai/scriptctl@0.65.3
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe automatic postinstall mutation of agent skill directories is a concrete extension lifecycle risk and warrants a warning. The inspected behavior is scoped to the package-owned scriptctl skill, so it does not establish a publish-block attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package with npm, unless an explicit opt-out environment variable is set.
Impact
The installed skill can affect later agent sessions, and an existing scriptctl skill in those locations is replaced.
Mechanism
The postinstall script copies the bundled skill into the .claude, .agents, and .codex skill roots under the user home directory, deleting each existing scriptctl directory first.
AI rationale
The automatic postinstall mutation of agent skill directories is a concrete extension lifecycle risk and warrants a warning. The inspected behavior is scoped to the package-owned scriptctl skill, so it does not establish a publish-block attack.
Evidence
package.jsonscripts/install-skill.mjs~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall runs scripts/install-skill.mjs.
- The installer targets the home-directory .claude, .agents, and .codex skill roots, and proceeds unless an opt-out environment variable is set.
- For each target it recursively removes the existing scriptctl directory, then copies in the package skill.
- The installed skill describes scriptctl commands for working with local script files.
Evidence against
- The inspected installer copies only the package-owned scriptctl skill; it does not show edits to broader agent settings or credential transfer.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/review-agent.jsView file
79L80: `)}),n.find=qn({id:"find",description:"\u6309\u6B63\u6587\u6B63\u5219 / \u8BF4\u8BDD\u4EBA / \u7C7B\u578B\u5B9A\u4F4D action\uFF0C\u8FD4\u56DE\u951A\u70B9 + \u4F4D\u7F6E + \u547D\u...
L81: `))[s(19)](s(7))}async function yu(e,t,n,o,s){let i=Dr,r=await fu(e,t,n),l=Date[i(8)]();try{let a=i(1)+t+i(17)+n+i(24)+(Sn(n)-Sn(t))+i(26)+t+i(3)+Sn(t)+i(10)+o+i(4),c=await Mi({con...
High
Child Process
Package source references child process execution.
dist/review-agent.jsView on unpkg · L7979L80: `)}),n.find=qn({id:"find",description:"\u6309\u6B63\u6587\u6B63\u5219 / \u8BF4\u8BDD\u4EBA / \u7C7B\u578B\u5B9A\u4F4D action\uFF0C\u8FD4\u56DE\u951A\u70B9 + \u4F4D\u7F6E + \u547D\u...
L81: `))[s(19)](s(7))}async function yu(e,t,n,o,s){let i=Dr,r=await fu(e,t,n),l=Date[i(8)]();try{let a=i(1)+t+i(17)+n+i(24)+(Sn(n)-Sn(t))+i(26)+t+i(3)+Sn(t)+i(10)+o+i(4),c=await Mi({con...
L82: `)}async function Ou(e,t){let n=process.env.SD_AUDIO_APIKEY?.trim();if(!n)throw new Error("\u5168\u5267 ASR \u7F3A\u5C11 SD_AUDIO_APIKEY\uFF0C\u5C1A\u672A\u542F\u52A8\u5267\u672C\u...
L83: `);return n}function xu(e,t){let n=Pt;return t+(e?.[n(52)][n(6)]((o,s)=>o+vu(s)[n(49)],0)??0)}function by(e){let t=Pt;return e?[t(37),t(18),e[t(23)],...e[t(39)][t(42)](n=>t(61)+n[t...
Findings
2 Critical6 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
CriticalPrevious Version Dangerous Deltadist/chunk-TPKRTUVV.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/review-agent.js
HighSame File Env Network Executiondist/review-agent.js
HighCommand Output Exfiltrationdist/review-agent.js
HighCloud Metadata Accessdist/review-agent.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-TPKRTUVV.js
MediumDynamic Requiredist/chunk-TPKRTUVV.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.65.3.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.65.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.