registry / AI-agent control-surface risk / @szc-ft/mcp-szcd-client

@szc-ft/mcp-szcd-client

MCP client for szcd component library - auto-configures AI coding tools with MCP server, skills, agents and commands

This report shows the evidence for @szc-ft/mcp-szcd-client@0.38.0. 1 of 3 known versions is blocked or flagged. The newest version, 0.40.0, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

源码确认了安装时对多个非本包拥有的 AI 工具用户配置的持久化修改，满足阻断条件。运行时还存在向默认远程 MCP 服务转发本地认证配置的具体链路。

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install @szc-ft/mcp-szcd-client

Impact

持久化扩展 Codex、Claude、Qwen、OpenCode 等的用户级 AI 代理能力，并使其连接包指定的远程 MCP 服务。

Mechanism

postinstall 注入跨平台代理/MCP 配置、技能和代理指令

Policy narrative

安装生命周期默认运行完整设置：写入或调用多个 AI 工具的用户级 MCP 配置，复制技能/命令，并以默认的远程 szcd MCP URL 注册服务；即使 Codex CLI 不存在也直接写入其配置。运行代理时，代码会把本地配置中的 CODING cookies、密码和 API key 放入请求头发往该端点，且 HTTPS 请求关闭证书校验。这构成未获同意的广泛 AI 代理控制面变更。

AI rationale

Evidence

package.jsonscripts/postinstall.jsscripts/lib/common.jsscripts/lib/codex.jsscripts/lib/claude-code.jsmcp-proxy.jsscripts/lib/qwen-code.jsscripts/lib/opencode.js~/.codex/config.toml~/.claude.json~/.qwen/extensions/szcd-component-helper~/.config/opencode/opencode.jsonc~/.agents/skills

Network endpoints2

mcp.szcd-mcp.top/mcpmcp.szcd-mcp.top

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json 在安装时无条件运行 scripts/postinstall.js。
scripts/postinstall.js 默认执行完整 IDE 配置并调用 setupCodex、Claude、Qwen、OpenCode 等。
scripts/lib/codex.js 写入 ~/.codex/config.toml、注册 MCP，并复制技能到 ~/.agents/skills。
scripts/lib/claude-code.js 直接修改 ~/.claude.json 的用户级 mcpServers。
scripts/lib/common.js 默认远程端点为 https://mcp.szcd-mcp.top；postinstall 还执行 npm install -g @szc-ft/sketch-mcp-server。
mcp-proxy.js 将本地 CODING cookies/password 编码为 X-Client-Config 转发到配置的 MCP 端点，并禁用 TLS 证书校验。

Evidence against

代理和配置脚本的用途在包描述及源码注释中明示。
未发现安装阶段直接读取系统凭据或直接发起 HTTP 请求；凭据转发发生在代理运行时。

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 137 file(s), 1.86 MB of source, external domains: a.com, api.example.com, cdn.jsdelivr.net, default.com, e-kjr1wok.coding.smartcitysz.work, example.com, github.com, httpbin.org, mcp.szcd-mcp.top, npmmirror.com, opencode.ai, platform.aicityos.com, registry.npmmirror.com, stg.com, stg.example.com, test.example.com, www.apple.com, www.google.com, x.com, yapi.smartcitysz.work

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView file

285it('build 后 qwen-extension 含 3 个新 lib 文件', async () => { L286: const { spawnSync } = await import('node:child_process'); L287: // build 并发跑 ENOTEMPTY race condition（PR #0 rmSync），加 retry

High

Child Process

Package source references child process execution.

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView on unpkg · L285

qwen-extension/skills/local-browser-test/lib/cdp-browser-config.jsView file

31} catch { L32: // 方案2：PowerShell Get-CimInstance L33: try {

High

Shell

Package source references shell execution.

qwen-extension/skills/local-browser-test/lib/cdp-browser-config.jsView on unpkg · L31

qwen-extension/skills/local-browser-test/lib/browser-engine.jsView file

3232try { L3233: this._cdpScripts[step.name] = new Function('page', 'frame', 'params', 'browser', 'return (' + step.code + ')(page, frame, params, browser)'); L3234: return { type: 'registerCdpScript', name: step.name, registered: true, status: 'PASS', passed: true };

Low

Eval

Package source references a known benign dynamic code generation pattern.

qwen-extension/skills/local-browser-test/lib/browser-engine.jsView on unpkg · L3232

qwen-extension/skills/local-browser-test/tests/integration/pr-04.test.jsView file

23L24: const { resolveCodeFile, detectNodeOnlyApi, buildErrorResult } = await import( L25: '../../lib/raw-script-helpers.js'

Medium

Dynamic Require

Package source references dynamic require/import behavior.

qwen-extension/skills/local-browser-test/tests/integration/pr-04.test.jsView on unpkg · L23

scripts/postinstall.jsView file

22Install-time AI-agent control hijack evidence: L107: L108: common.writeFile(configPath, JSON.stringify(configContent, null, 2)); L109: } ... L131: } L132: if (claudeResult.claudeProjectInstalled) { L133: console.log(` Claude Project: ${path.join(projectRoot, ".claude", "skills", common.getMcpServerName(), "SKILL.md")}`); L134: } ... L142: /* L143: if (openCodeResult.openCodeProjectInstalled) { L144: console.log(` OpenCode Project: ${path.join(projectRoot, ".opencode", "skills", common.getMcpServerName(), "SKILL.md")}`); L145: } Payload evidence from agents/build.js: L22: const __filename = fileURLToPath(import.meta.url); L23: const __dirname = path.dirname(__filename); L24: ... L259: const templateContent = fs.readFileSync(templatePath, "utf8"); L260: const tools = JSON.parse(fs.read

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L22

qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.jsView file

22Cross-file remote execution chain: qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.js spawns qwen-extension/skills/local-browser-test/lib/browser-engine.js; helper contains network access plus dynamic code execution. L22: const __filename = fileURLToPath(import.meta.url); L23: const __dirname = path.dirname(__filename); L24: const SKILL_DIR = path.resolve(__dirname, '../../'); ... L232: it('build 后 qwen-extension 含 retry-policy.js', async () => { L233: const { spawnSync } = await import('node:child_process'); L234: let result; ... L240: if (result.status === 0) break; L241: if (result.stderr?.toString().includes('ENOTEMPTY')) { L242: await new Promise((r) => setTimeout(r, 500));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.jsView on unpkg · L22

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView file

87try { L88: execSync(`npm install ${installFlags} ${pkgList}`.trim(), { L89: cwd: SHARED_DEPS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView on unpkg · L87

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView file

•path = qwen-extension/skills/local-api-tool/scripts/extract_swagger.py kind = build_helper sizeBytes = 23931 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView on unpkg

qwen-extension/commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in qwen-extension/commands/szcd-mcp-api-config.md

qwen-extension/commands/szcd-mcp-api-config.mdView on unpkg · L28

qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.js

qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in commands/szcd-mcp-api-config.md

commands/szcd-mcp-api-config.mdView on unpkg · L28

opencode-extension/commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in opencode-extension/commands/szcd-mcp-api-config.md

opencode-extension/commands/szcd-mcp-api-config.mdView on unpkg · L28

opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.js

opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

standard-skill/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in standard-skill/local-browser-test/tests/integration/pr-01.test.js

standard-skill/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView file

High

Child Process

Findings

1 Critical5 High12 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processqwen-extension/skills/local-browser-test/tests/integration/pr-03.test.js

HighShellqwen-extension/skills/local-browser-test/lib/cdp-browser-config.js

HighCross File Remote Execution Contextqwen-extension/skills/local-browser-test/tests/integration/pr-06.test.js

HighRuntime Package Installqwen-extension/skills/local-browser-test/lib/shared-deps.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireqwen-extension/skills/local-browser-test/tests/integration/pr-04.test.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @szc-ft/mcp-szcd-client@0.38.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @szc-ft/mcp-szcd-client@0.38.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-29 20:36:07.573Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.40.0latestSuspicious—WarnUnder ReviewAug 13, 2026, 2:11 AM 0.39.0Suspicious—WarnUnder ReviewJul 1, 2026, 10:52 AM 0.38.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 1, 2026, 7:48 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code