registry / bfi-cli / 0.1.13

bfi-cli@0.1.13

用友大业财BFI统一命令行工具，支持技能，技能包，元数据，UI元数据等

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `bfi add`, `bfi skills add`, `bfi update`, or related CLI commands.

Impact

Downloaded skill content can influence an agent when the user later uses that agent; no stealth or automatic activation by npm install is established.

Mechanism

User-directed remote skill acquisition and AI-agent skill-directory installation.

Rationale

No concrete malicious chain is present, but the package intentionally provides explicit user-command installation into multiple AI-agent skill surfaces. Treat it as a warned dangerous capability rather than a publish-blocking malware package.

Evidence

package.jsonbin/bfi.mjsdist/cli.mjsdist/_chunks/agents.mjs~/.bfi/config.json~/.bfi/agents-cache.json

Network endpoints5

bfi.yyuap.com:811skills.shapi.github.comgithub.comgitlab.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli.mjs` installs copied/symlinked skills into configured AI-agent skill directories.
`dist/cli.mjs` fetches/clones skill sources only through explicit CLI commands such as `add`, `update`, and `search`.
`dist/_chunks/agents.mjs` caches remotely supplied agent definitions in `~/.bfi/agents-cache.json`.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook executes for consumers.
`bin/bfi.mjs` only enables Node's compile cache then imports the CLI.
No credential harvesting, exfiltration routine, eval/vm use, or payload execution was found.
Network use targets configured SkillHub/marketplace and user-requested GitHub/GitLab sources.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 13 file(s), 494 KB of source, external domains: api.github.com, bfi.yyuap.com, connectors-skills.zapier.com, example.com, github.com, gitlab.com, raw.githubusercontent.com, schemas.agentskills.io, skillhub.example.com, skillhub.skillhub.woa.com, skills.sh

Source & flagged code

2 flagged

dist/_chunks/libs/simple-git.mjsView file

Lines 1-26javascript

1import { __toESM } from "../rolldown-runtime.mjs";

2import { require_dist, require_src } from "./@kwsites/file-exists.mjs";

3import { c, o, r } from "./@simple-git/args-pathspec.mjs";

4import { require_dist as require_dist$1 } from "./@kwsites/promise-deferred.mjs";

5import { ne } from "./@simple-git/argv-parser.mjs";

6import { normalize } from "node:path";

7import { spawn } from "child_process";

8import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L6

9var import_dist = require_dist();

10var import_src = /* @__PURE__ */ __toESM(require_src(), 1);

11var import_dist$1 = require_dist$1();

12var __defProp = Object.defineProperty;

13var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

14var __getOwnPropNames = Object.getOwnPropertyNames;

15var __hasOwnProp = Object.prototype.hasOwnProperty;

16var __esm = (fn, res) => function __init() {

17 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

18};

19var __commonJS = (cb, mod) => function __require() {

20 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

21};

22var __export = (target, all) => {

23 for (var name in all) __defProp(target, name, {

24 get: all[name],

25 enumerable: true

26 });

dist/cli.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { __exportAll, __toESM } from "./_chunks/rolldown-runtime.mjs";

3import { isCancel } from "./_chunks/libs/@clack/core.mjs";

4import { cancel, confirm, groupMultiselect, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";

5import { require_picocolors } from "./_chunks/libs/picocolors.mjs";

6import

Source & flagged code

2 flagged · loading source

dist/_chunks/libs/simple-git.mjsView file

6import { normalize } from "node:path"; L7: import { spawn } from "child_process"; L8: import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L6

dist/cli.mjsView file

17Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution. L17: import { Writable } from "stream"; L18: import https from "node:https"; L19: import http from "node:http"; L20: import os$1 from "node:os"; L21: import zlib, { gunzipSync, inflateRawSync } from "node:zlib"; L22: import { promisify } from "util"; L23: import { execFile, execSync, spawn, spawnSync } from "child_process"; L24: import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises"; ... L61: } L62: async function isRepoPrivate(owner, repo) { L63: try { ... L295: function countVisualRowsForLines(lines, columns) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L17

Findings

3 High3 Medium5 Low

HighChild Processdist/_chunks/libs/simple-git.mjs

HighShell

HighCross File Remote Execution Contextdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/_chunks/libs/simple-git.mjsView file

Lines 1-26javascript

1import { __toESM } from "../rolldown-runtime.mjs";

2import { require_dist, require_src } from "./@kwsites/file-exists.mjs";

3import { c, o, r } from "./@simple-git/args-pathspec.mjs";

4import { require_dist as require_dist$1 } from "./@kwsites/promise-deferred.mjs";

5import { ne } from "./@simple-git/argv-parser.mjs";

6import { normalize } from "node:path";

7import { spawn } from "child_process";

8import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L6

9var import_dist = require_dist();

10var import_src = /* @__PURE__ */ __toESM(require_src(), 1);

11var import_dist$1 = require_dist$1();

12var __defProp = Object.defineProperty;

13var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

14var __getOwnPropNames = Object.getOwnPropertyNames;

15var __hasOwnProp = Object.prototype.hasOwnProperty;

16var __esm = (fn, res) => function __init() {

17 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

18};

19var __commonJS = (cb, mod) => function __require() {

20 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

21};

22var __export = (target, all) => {

23 for (var name in all) __defProp(target, name, {

24 get: all[name],

25 enumerable: true

26 });

dist/cli.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { __exportAll, __toESM } from "./_chunks/rolldown-runtime.mjs";

3import { isCancel } from "./_chunks/libs/@clack/core.mjs";

4import { cancel, confirm, groupMultiselect, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";

5import { require_picocolors } from "./_chunks/libs/picocolors.mjs";

6import