registry / baskreport-ai-report-generator / 1.0.4

baskreport-ai-report-generator@1.0.4

AI 报表生成器 Skill 包：将 LLM 产出的精简 JSON 中间层编译为 BaskReport 报表 XML，支持服务端写入与离线导出。

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an automatic lifecycle mutation of AI-client extension directories, so it is a real extension-lifecycle risk. Source inspection did not establish credential exfiltration, remote code loading, or a nested self-dependency chain.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs postinstall.

Impact

CodeBuddy and WorkBuddy may load the package skill in later sessions.

Mechanism

Creates user-level skill-directory symlinks to the package.

AI rationale

Evidence

package.jsondist/install.js~/.codebuddy/skills/baskreport-ai-report-generator~/.workbuddy/skills/baskreport-ai-report-generatorSKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The postinstall hook automatically invokes the skill installer.
The installer creates user-level AI-client skill-directory symlinks for CodeBuddy and WorkBuddy.
The install hook suppresses failures, reducing visibility of the automatic mutation.

Evidence against

No self-dependency or secondary lifecycle chain is declared.
No fixed credential-exfiltration endpoint or hidden remote payload loader was found.
Network code targets a user-configured BaskReport server for the package's report API.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 1.09 MB of source, external domains: basksoft.ai, json-schema.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

8147init_esm_shims(); L8148: import { execSync } from "child_process"; L8149: import * as fs3 from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L8147

7607if (opts.category && filtered.length === 0) { L7608: console.log("\u63D0\u793A\uFF1A--category \u672A\u5339\u914D\u5230\u5206\u7C7B\uFF08PowerShell/\u81EA\u52A8\u5316\u901A\u9053\u4E2D\u6587\u53EF\u80FD\u4E71\u7801\uFF09\uFF0C\u8BF7\... L7609: }

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L7607

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { existsSync, readFileSync, writeFileSync } from "fs"; const baseUrl = pickString( flag.baseUrl, json.baseUrl baseUrl: baseUrl ?? "", if (!auth.baseUrl) miss.push("baseUrl"); - \u65B9\u5F0F\u4E00\uFF08OAuth2\uFF09\uFF1A\u63D0\u4F9B --access-token / BASK_ACCESS_TOKEN\uFF08token \u7ECF Authorization header \u643A\u5E26\uFF09 - \u6216\u547D\u4EE4\u884C\u663E\u5F0F\u4F20 --${miss.map((m) => m === "baseUrl" ? "base-url" : m).join(" / --")}

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

8289console.log("\n[1/3] \u6784\u5EFA\u4EA7\u7269..."); L8290: execSync("npm install && npm run build", { cwd: skillRoot, stdio: "inherit" }); L8291: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L8289

dist/install.jsView file

68function genClaudeCommand(projectRoot, body) { L69: const dir = path.join(projectRoot, ".claude", "commands"); L70: fs.mkdirSync(dir, { recursive: true }); L71: const out = path.join(dir, "baskreport.md"); ... L78: ].join("\n"); L79: fs.writeFileSync(out, header + body, "utf8"); L80: console.log(` \u5DF2\u751F\u6210: ${out}`); ... L83: const dir = path.join(projectRoot, ".cursor", "rules"); L84: fs.mkdirSync(dir, { recursive: true }); L85: const out = path.join(dir, "basksoft-ai.mdc"); ... L101: ].join("\n"); L102: fs.writeFileSync(out, fm + header + body, "utf8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install.jsView on unpkg · L68

scripts/install-skill.tsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: function gengenericskill(skillroot: string, body: string): void { fs.mkdirsync(skillroot, { recursive: true }); const out = path.join(skillroot, "baskreport.md"); const header = [ "", "", ].join("\n"); fs.writefilesync(out, header + body, "utf8"); console.log(` 已生成: ${out}`); }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.tsView on unpkg

scripts/install-skill.ps1View file

•path = scripts/install-skill.ps1 kind = build_helper sizeBytes = 11200 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skill.ps1View on unpkg

scripts/clean-unused-fields.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/clean-unused-fields.tsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.js --clients codebuddy,workbuddy || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

8147init_esm_shims(); L8148: import { execSync } from "child_process"; L8149: import * as fs3 from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L8147

Findings

1 Critical7 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighShelldist/cli/index.js

HighCredential Redirect Persistencedist/cli/index.js

HighExternal Ai Agent Control Surface Mutationscripts/install-skill.ts

HighRuntime Package Installdist/cli/index.js

HighSemantic Analysis Limitedscripts/clean-unused-fields.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-skill.ps1

Affected versions and remediation

This report applies to baskreport-ai-report-generator@1.0.4.

See all versions of baskreport-ai-report-generator for other recorded verdicts.

Review the evidence and your use of baskreport-ai-report-generator@1.0.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 13:54:20.266Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.