registry / @lingjingai/scriptctl / 0.66.14
@lingjingai/scriptctl@0.66.14
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 2d ago · by lpm-firewall-aiSource confirms an automatic postinstall setup of a first-party agent skill, limited to its own named subdirectory and guarded by opt-out variables. This warrants a warning for agent extension lifecycle risk; the inspected source does not establish broader control-surface abuse or a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the npm package with lifecycle scripts enabled, unless an opt-out environment variable is set.
Impact
The installed agent skill may influence later agent interactions, and an existing scriptctl skill is replaced. The inspected source shows package-owned setup, with no evidence of broader agent configuration changes.
Mechanism
The installer copies the bundled skill into the scriptctl subdirectory under three agent skill roots in the user’s home directory, removing the prior subdirectory first.
AI rationale
Source confirms an automatic postinstall setup of a first-party agent skill, limited to its own named subdirectory and guarded by opt-out variables. This warrants a warning for agent extension lifecycle risk; the inspected source does not establish broader control-surface abuse or a concrete attack.
Evidence
package.jsonscripts/install-skill.mjsskills/scriptctl/SKILL.md.claude/skills/scriptctl.agents/skills/scriptctl.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install-skill.mjs automatically after installation.
- The installer targets skill directories for Claude Code, agents, and Codex, and removes and replaces only each directory’s scriptctl subfolder with the package’s skill.
- The installer runs by default; environment variables can opt out.
- The bundled skill describes using scriptctl to read and modify local scripts, then publish changes.
Evidence against
- The install operation is limited to the package-owned scriptctl skill subdirectory; it does not overwrite adjacent skills.
- The skill describes the package’s script editing workflow, and the CLI update behavior is an explicit user command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/chunk-MMH5EEBU.jsView file
164`);try{return await this.tracked(h,()=>o(m))}catch(g){throw bo(g,n)?Yi(g,[...c,ii(g,h)]):g}}}throw new Error("Text model routes cannot be empty.")}async generateText(t,n){let o=An[...
L165: `),data:{checks:L}},G]}import{spawn as Qx}from"node:child_process";var ca="@lingjingai/scriptctl",Yx=`${ca}@latest`,Qd="npm";function qx(){return zi()}function Zx(e){let t=/^(\d+)\...
L166: `),data:{op:"update",changed:!1,update:a}},G];let d=await t(Qd,s);if(d.error)throw new x(`Failed to start npm: ${d.error.message}`,{exitCode:X,errorCode:"UPDATE_SPAWN_FAILED",hint:...
High
Child Process
Package source references child process execution.
dist/chunk-MMH5EEBU.jsView on unpkg · L164152L153: \u53EA\u8FD4\u56DE JSON \u5BF9\u8C61\u672C\u8EAB\uFF0C\u4E0D\u8981\u8F93\u51FA\u4EFB\u4F55\u89E3\u91CA\u3001\u524D\u8A00\u3001Markdown \u4EE3\u7801\u5757\u6216\u5176\u4ED6\u6587\u5...
L154: Gemini \u4E0A\u4F20\u4F1A\u6210\u529F\u3001\u968F\u540E\u7684\u6587\u4EF6\u8F6E\u8BE2/\u751F\u6210\u4F1A\u6302\uFF08Node \u5185\u7F6E fetch \u9ED8\u8BA4\u4E0D\u8D70\u4EE3\u7406\uFF...
...
L156: `),{files:{upload:c=>Uf({apiKey:e,filePath:c.file,mimeType:c.config?.mimeType??"video/mp4",timeoutMs:t,proxyUrl:s,baseUrl:n}),get:c=>r.files.get(c),delete:c=>r.files.delete(c)},mod...
L157: `).trim():""}function Df(e){try{return JSON.parse(e)}catch{throw new T("invalid_response","Provider returned invalid JSON.",{details:[e.slice(0,500)]})}}var ra=class{constructor(t,...
L158: `),a={kind:"base64",dat
Findings
1 Critical6 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/chunk-MMH5EEBU.js
HighSame File Env Network Executiondist/chunk-MMH5EEBU.js
HighCommand Output Exfiltrationdist/chunk-MMH5EEBU.js
HighCloud Metadata Accessdist/review-agent.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-MMH5EEBU.js
MediumDynamic Requiredist/chunk-MMH5EEBU.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.66.14.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.66.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.