registry / AI-agent control-surface risk / baskreport-ai-report-generator

baskreport-ai-report-generator

AI 报表生成器 Skill 包：将 LLM 产出的精简 JSON 中间层编译为 BaskReport 报表 XML，支持服务端写入与离线导出。

This report shows the evidence for baskreport-ai-report-generator@1.0.2. 2 of 5 known versions are blocked or flagged. The newest version, 1.0.4, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source confirms unconsented postinstall mutation of foreign AI-agent control surfaces. The absence of credential exfiltration does not remove this concrete install-time control-surface attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation

Impact

The package becomes automatically discoverable as an AI-agent skill in external user-level control surfaces.

Mechanism

postinstall-created AI-client skill symlinks

Policy narrative

npm invokes dist/install.js during postinstall with CodeBuddy and WorkBuddy selected. The installer creates their user-level skills directories, removes an existing symlink at its target, and symlinks the package root there, causing its SKILL.md to be loaded by those external AI clients. The install is automatic and does not require the user to run the package CLI.

AI rationale

Source confirms unconsented postinstall mutation of foreign AI-agent control surfaces. The absence of credential exfiltration does not remove this concrete install-time control-surface attack.

Evidence

package.jsonsrc/install-skill.tsdist/install.jsSKILL.md~/.codebuddy/skills/<installed-package-directory>~/.workbuddy/skills/<installed-package-directory>

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall automatically runs the skill installer for codebuddy and workbuddy.
Installer defaults to those AI clients and creates user-level skill directories.
Installer replaces an existing symlink and creates a new symlink to the package skill.
This mutation occurs without an explicit user command.

Evidence against

No exfiltration endpoint or remote payload execution was found in inspected source.
Runtime API requests use a user-supplied BaskReport base URL and supplied credentials.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 686 KB of source, external domains: basksoft.ai, json-schema.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

4462init_esm_shims(); L4463: import { execSync } from "child_process"; L4464: import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4462

3671if (opts.category && filtered.length === 0) { L3672: console.log("\u63D0\u793A\uFF1A--category \u672A\u5339\u914D\u5230\u5206\u7C7B\uFF08PowerShell/\u81EA\u52A8\u5316\u901A\u9053\u4E2D\u6587\u53EF\u80FD\u4E71\u7801\uFF09\uFF0C\u8BF7\... L3673: }

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L3671

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { existsSync, readFileSync, writeFileSync } from "fs"; const baseUrl = pickString( flag.baseUrl, json.baseUrl baseUrl: baseUrl ?? "", if (!auth.baseUrl) miss.push("baseUrl"); - \u65B9\u5F0F\u4E00\uFF08OAuth2\uFF09\uFF1A\u63D0\u4F9B --access-token / BASK_ACCESS_TOKEN\uFF08token \u7ECF Authorization header \u643A\u5E26\uFF09 - \u6216\u547D\u4EE4\u884C\u663E\u5F0F\u4F20 --${miss.map((m) => m === "baseUrl" ? "base-url" : m).join(" / --")}

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

4604console.log("\n[1/3] \u6784\u5EFA\u4EA7\u7269..."); L4605: execSync("npm install && npm run build", { cwd: skillRoot, stdio: "inherit" }); L4606: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L4604

dist/install.jsView file

68function genClaudeCommand(projectRoot, body) { L69: const dir = path.join(projectRoot, ".claude", "commands"); L70: fs.mkdirSync(dir, { recursive: true }); L71: const out = path.join(dir, "baskreport.md"); ... L78: ].join("\n"); L79: fs.writeFileSync(out, header + body, "utf8"); L80: console.log(` \u5DF2\u751F\u6210: ${out}`); ... L83: const dir = path.join(projectRoot, ".cursor", "rules"); L84: fs.mkdirSync(dir, { recursive: true }); L85: const out = path.join(dir, "basksoft-ai.mdc"); ... L101: ].join("\n"); L102: fs.writeFileSync(out, fm + header + body, "utf8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install.jsView on unpkg · L68

scripts/install-skill.tsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: function gengenericskill(skillroot: string, body: string): void { fs.mkdirsync(skillroot, { recursive: true }); const out = path.join(skillroot, "baskreport.md"); const header = [ "", "", ].join("\n"); fs.writefilesync(out, header + body, "utf8"); console.log(` 已生成: ${out}`); }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.tsView on unpkg

scripts/install-skill.ps1View file

•path = scripts/install-skill.ps1 kind = build_helper sizeBytes = 11200 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skill.ps1View on unpkg

scripts/strip-base64.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/strip-base64.tsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

4462init_esm_shims(); L4463: import { execSync } from "child_process"; L4464: import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4462

Findings

1 Critical7 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighCredential Redirect Persistencedist/cli/index.js

HighExternal Ai Agent Control Surface Mutationscripts/install-skill.ts

HighRuntime Package Installdist/cli/index.js

HighSemantic Analysis Limitedscripts/strip-base64.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-skill.ps1

Affected versions and remediation

This report applies to baskreport-ai-report-generator@1.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing baskreport-ai-report-generator@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 22:19:36.496Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

1.0.4latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 1, 2026, 1:47 PM 1.0.3Scan Failed—AllowUnder ReviewAug 28, 2026, 7:33 AM 1.0.2shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 24, 2026, 10:33 AM 1.0.1SuspiciousAgent extension lifecycle riskWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code