Loading npm security reports…

baskreport-ai-report-generator@1.0.2: AI-agent control-surface | LPM Firewall

registry / baskreport-ai-report-generator / 1.0.2

baskreport-ai-report-generator@1.0.2

AI 报表生成器 Skill 包：将 LLM 产出的精简 JSON 中间层编译为 BaskReport 报表 XML，支持服务端写入与离线导出。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall hook that registers its SKILL.md in CodeBuddy and WorkBuddy user-level skill directories. This alters AI-agent behavior outside the installed package without user invocation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation

Impact

The package becomes automatically discoverable as an AI-agent skill in external user-level control surfaces.

Mechanism

postinstall-created AI-client skill symlinks

Policy narrative

npm invokes dist/install.js during postinstall with CodeBuddy and WorkBuddy selected. The installer creates their user-level skills directories, removes an existing symlink at its target, and symlinks the package root there, causing its SKILL.md to be loaded by those external AI clients. The install is automatic and does not require the user to run the package CLI.

Rationale

Source confirms unconsented postinstall mutation of foreign AI-agent control surfaces. The absence of credential exfiltration does not remove this concrete install-time control-surface attack.

Evidence

package.jsonsrc/install-skill.tsdist/install.jsSKILL.md~/.codebuddy/skills/<installed-package-directory>~/.workbuddy/skills/<installed-package-directory>

Decision evidence

public snapshot

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

4462init_esm_shims(); L4463: import { execSync } from "child_process"; L4464: import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4462

3671if (opts.category && filtered.length === 0) { L3672: console.log("\u63D0\u793A\uFF1A--category \u672A\u5339\u914D\u5230\u5206\u7C7B\uFF08PowerShell/\u81EA\u52A8\u5316\u901A\u9053\u4E2D\u6587\u53EF\u80FD\u4E71\u7801\uFF09\uFF0C\u8BF7\... L3673: }

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L3671

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { existsSync, readFileSync, writeFileSync } from "fs"; const baseUrl = pickString( flag.baseUrl, json.baseUrl baseUrl: baseUrl ?? "", if (!auth.baseUrl) miss.push("baseUrl"); - \u65B9\u5F0F\u4E00\uFF08OAuth2\uFF09\uFF1A\u63D0\u4F9B --access-token / BASK_ACCESS_TOKEN\uFF08token \u7ECF Authorization header \u643A\u5E26\uFF09 - \u6216\u547D\u4EE4\u884C\u663E\u5F0F\u4F20 --${miss.map((m) => m === "baseUrl" ? "base-url" : m).join(" / --")}

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

4604console.log("\n[1/3] \u6784\u5EFA\u4EA7\u7269..."); L4605: execSync("npm install && npm run build", { cwd: skillRoot, stdio: "inherit" }); L4606: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L4604

dist/install.jsView file

68function genClaudeCommand(projectRoot, body) { L69: const dir = path.join(projectRoot, ".claude", "commands"); L70: fs.mkdirSync(dir, { recursive: true }); L71: const out = path.join(dir, "baskreport.md"); ... L78: ].join("\n"); L79: fs.writeFileSync(out, header + body, "utf8"); L80: console.log(` \u5DF2\u751F\u6210: ${out}`); ... L83: const dir = path.join(projectRoot, ".cursor", "rules"); L84: fs.mkdirSync(dir, { recursive: true }); L85: const out = path.join(dir, "basksoft-ai.mdc"); ... L101: ].join("\n"); L102: fs.writeFileSync(out, fm + header + body, "utf8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install.jsView on unpkg · L68

scripts/install-skill.tsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: function gengenericskill(skillroot: string, body: string): void { fs.mkdirsync(skillroot, { recursive: true }); const out = path.join(skillroot, "baskreport.md"); const header = [ "", "", ].join("\n"); fs.writefilesync(out, header + body, "utf8"); console.log(` 已生成: ${out}`); }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.tsView on unpkg

scripts/install-skill.ps1View file

•path = scripts/install-skill.ps1 kind = build_helper sizeBytes = 11200 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skill.ps1View on unpkg

scripts/strip-base64.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/strip-base64.tsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 9-49json

9 },

10 "type": "module",

11 "engines": {

12 "node": ">=18"

13 },

14 "bin": {

15 "baskreport": "dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "SKILL.md",

20 "src",

21 "scripts",

22 "CHANGELOG.md",

23 "LICENSE"

24 ],

25 "scripts": {

26 "prebuild": "tsx scripts/extract-ai-view.ts --quiet",

27 "build": "tsup",

28 "prepublishOnly": "tsx scripts/extract-ai-view.ts --quiet && npm run build",

29 "postinstall": "node dist/install.js --clients codebuddy,workbuddy || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "test": "vitest run",

31 "test:watch": "vitest",

32 "typecheck": "tsc --noEmit",

33 "xml2json": "tsx scripts/xml-to-json.ts",

34 "strip-base64": "tsx scripts/strip-base64.ts",

35 "install:skill": "tsx scripts/extract-ai-view.ts --quiet && tsx scripts/install-skill.ts --clients all",

36 "install:skill:build": "tsx scripts/extract-ai-view.ts --quiet && tsx scripts/install-skill.ts --clients all --build",

37 "uninstall:skill": "tsx scripts/install-skill.ts --uninstall --clients all"

38 },

39 "dependencies": {

40 "ajv": "^8.17.1",

41 "ajv-formats": "^3.0.1",

42 "commander": "^12.1.0",

43 "fast-xml-parser": "^4.5.7",

44 "undici": "^6.19.8",

45 "xmlbuilder2": "^3.1.1"

46 },

47 "devDependencies": {

48 "@types/node": "^20.19.43",

49 "tsup": "^8.2.4",

dist/cli/index.jsView file

Lines 3651-3691javascript

3651 });

3652 if (opts.json) {

3653 console.log(JSON.stringify(funcs, null, 2));

3654 return;

3655 }

3656 const

dist/install.jsView file

Lines 48-88javascript

48function isLink(targetPath) {

49 try {

50 return fs.lstatSync(targetPath).isSymbolicLink();

51 } catch {

52 return false

scripts/install-skill.tsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: function gengenericskill(skillroot: string, body: string): void { fs.mkdirsync(skillroot, { recursive: true }); const out = path.join(skillroot, "baskreport.md"); const header = [ "", "", ].join("\n"); fs.writefilesync(out, header + body, "utf8"); console.log(` 已生成: ${out}`); }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.tsView on unpkg

scripts/install-skill.ps1View file

•path = scripts/install-skill.ps1 kind = build_helper sizeBytes = 11200 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skill.ps1View on unpkg

scripts/strip-base64.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/strip-base64.tsView on unpkg

Lines 4442-4482javascript

4442 r.command("create-from-xml").description("\u7531\u672C\u5730 XML \u6587\u4EF6\u521B\u5EFA\u62A5\u8868\uFF08code \u7559\u7A7A\uFF0C\u540E\u7EED\u4EE5 --id \u5B9A\u4F4D\uFF09").requiredOption("--xml <file>", "XML \u6587\u4EF6").option("--name <name>", "\u62A5\u8868\u540D\u79F0").option("--parent-id <id>", "\u7236\u76EE\u5F55 ID\uFF0C\u7F3A\u7701 0")

4443 ).action(async (opts) => {

4444 const s = await loginResolved(opts, "report \u547D\u4EE4");

4445 const xml = readFileSync3(opts.xml, "utf-8");

4446 const file = await createReport(s, {

4447 parentId: opts.parentId ? Number(opts.parentId) : 0,

4448 name: opts.name ?? "AI \u751F\u6210\u7684\u62A5\u8868"

4449 });

4450 await updateReportXml(s, file.id, xml);

4451 console.log(` \u8BBE\u8BA1\u5668: ${designerUrl(s.baseUrl, file.id, s.tenantId)}`);

4452 console.log(` \u9884\u89C8: ${viewUrl(s.baseUrl, file.id, s.tenantId)}`);

4453 });

4454}

4455

4456// src/cli/install.ts

4457init_esm_shims();

4458import * as path3 from "path";

4459import { fileURLToPath as fileURLToPath4 } from "url";

4460

4461// src/install-skill.ts

4462init_esm_shims();

4463import { execSync } from "child_process";

4464import * as fs from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4462

4465import * as path2 from "path";

4466import * as os from "os";

4467import { fileURLToPath as fileURLToPath3 } from "url";

4468var KNOWN_CLIENTS = ["codebuddy", "workbuddy", "gemini", "codex", "claude", "cursor", "generic"];

4469function expandClients(raw) {

4470 const set = /* @__PURE__ */ new Set();

4471 for (const c of raw) {

4472 if (c === "all") {

4473 KNOWN_CLIENTS.forEach((k) => set.add(k));

4474 } else if (KNOWN_CLIENTS.includes(c)) {

4475 set.add(c);

4476 } else {

4477 throw new Error(`\u672A\u77E5\u5BA2\u6237\u7AEF: ${c}\u3002\u652F\u6301: ${KNOWN_CLIENTS.join(", ")} \u6216 all`);

4478 }

4479 }

4480 return [...set];

4481}

4482function parseArgs(argv) {

Lines 4584-4624javascript

4584 const header = [

4585 "<!--",

4586 "\u6B64\u6587\u4EF6\u7531 baskreport install --clients codex \u81EA\u52A8\u751F\u6210\uFF1B\u5982\u9700\u4FEE\u6539\u8BF7\u6539 SKILL.md \u540E\u91CD\u8DD1\u3002",

4587 "OpenAI Codex CLI \u4F1A\u81EA\u52A8\u52A0\u8F7D\u9879\u76EE\u6839\u7684 AGENTS.md\uFF1B\u5176\u4E2D\u5305\u542B BaskReport \u62A5\u8868\u751F\u6210\u6280\u80FD\u8BF4\u660E\u3002",

4588 "-->",

4589 ""

4590 ].join("\n");

4591 fs.writeFileSync(out, header + body, "utf8");

4592 console.log(` \u5DF2\u751F\u6210: ${out}`);

4593}

4594function runInstall(opts, skillRoot) {

4595 const skillMd = path2.join(skillRoot, "SKILL.md");

4596 if (!fs.existsSync(skillMd)) {

4597 throw new Error(`\u672A\u627E\u5230 SKILL.md\uFF0C\u8BF7\u786E\u8BA4\u8FD0\u884C\u76EE\u5F55\u6B63\u786E\u3002skillRoot=${skillRoot}`);

4598 }

4599 const skillName = path2.basename(skillRoot);

4600 console.log(`Skill \u540D\u79F0: ${skillName}`);

4601 console.log(`\u4ED3\u5E93\u8DEF\u5F84: ${skillRoot}`);

4602 console.log(`\u76EE\u6807\u5BA2\u6237\u7AEF: ${opts.clients.join(", ")}`);

4603 if (opts.build) {

4604 console.log("\n[1/3] \u6784\u5EFA\u4EA7\u7269...");

4605 execSync("npm install && npm run build", { cwd: skillRoot, stdio: "inherit" });

4606 } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L4604

4607 console.log("\n[1/3] \u8DF3\u8FC7\u6784\u5EFA");

4608 }

4609 const { description, body } = readSkillMeta(skillMd);

4610 console.log("[2/3] \u521B\u5EFA\u5BA2\u6237\u7AEF\u94FE\u63A5 / \u751F\u6210\u547D\u4EE4\u4E0E\u89C4\u5219...");

4611 const homeDir = os.homedir();

4612 for (const client of opts.clients) {

4613 if (client === "claude") {

4614 const root = opts.projectRoot ?? skillRoot;

4615 genClaudeCommand(root, body);

4616 continue;

4617 }

4618 if (client === "cursor") {

4619 const root = opts.projectRoot ?? skillRoot;

4620 genCursorRule(root, description, body);

4621 continue;

4622 }

4623 if (client === "generic") {

4624 const root = opts.projectRoot ?? skillRoot;