registry / @lingjingai/scriptctl / 0.66.18
@lingjingai/scriptctl@0.66.18
剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe postinstall hook performs automatic user-level agent skill setup, with only an opt-out and a narrow package-owned destination. This supports a warning for agent extension lifecycle risk, but the inspected source does not establish a broader control-surface attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm runs the package postinstall hook, unless the documented environment-variable opt-out is set or the source-checkout guard applies.
Impact
Agents using these skill directories may receive the package's scriptctl instructions after installation; an existing scriptctl skill in those locations is replaced.
Mechanism
The installer copies the bundled skill into the Claude, agents, and Codex skill roots under the user's home directory, replacing the existing scriptctl subdirectory.
AI rationale
The postinstall hook performs automatic user-level agent skill setup, with only an opt-out and a narrow package-owned destination. This supports a warning for agent extension lifecycle risk, but the inspected source does not establish a broader control-surface attack.
Evidence
package.jsonscripts/install-skill.mjsskills/scriptctl/SKILL.md~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook automatically runs the skill installer.
- The installer targets user-level Claude, agents, and Codex skill directories and replaces any existing `scriptctl` skill there with the package copy.
- The only consent control is an environment-variable opt-out; installation proceeds by default.
- The installed skill provides agent-facing instructions for using scriptctl, creating a package-owned agent extension during installation.
Evidence against
- The installer is limited to the `scriptctl` subdirectory in each target and includes a source-checkout guard; inspected evidence does not establish broader agent configuration changes or data transfer.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/review-agent.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @lingjingai/scriptctl@0.66.17
matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.66.17
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/review-agent.jsView on unpkg82L83: `)}),o.find=Bo({id:"find",description:"\u6309\u6B63\u6587\u6B63\u5219 / \u8BF4\u8BDD\u4EBA / \u7C7B\u578B\u5B9A\u4F4D action\uFF0C\u8FD4\u56DE\u951A\u70B9 + \u4F4D\u7F6E + \u547D\u...
L84: `))[s(19)](s(7))}async function zu(e,t,o,n,s){let i=ua,r=await ju(e,t,o),l=Date[i(8)]();try{let a=i(1)+t+i(17)+o+i(24)+(Ko(o)-Ko(t))+i(26)+t+i(3)+Ko(t)+i(10)+n+i(4),c=await Ji({con...
Findings
2 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
CriticalPrevious Version Dangerous Deltadist/review-agent.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/review-agent.js
HighSame File Env Network Executiondist/review-agent.js
HighCommand Output Exfiltrationdist/review-agent.js
HighCloud Metadata Accessdist/review-agent.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-QCTGU6FJ.js
MediumDynamic Requiredist/chunk-QCTGU6FJ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @lingjingai/scriptctl@0.66.18.
See all versions of @lingjingai/scriptctl for other recorded verdicts.
- Review the evidence and your use of @lingjingai/scriptctl@0.66.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.