registry / bfi-cli / 0.1.20

bfi-cli@0.1.20

用友大业财BFI统一命令行工具，支持技能，技能包，元数据，UI元数据等

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `bfi add` or `bfi skills add` and selects or supplies a source/agent, optionally with noninteractive flags.

Impact

A user-selected untrusted skill can alter an agent's available instructions/capabilities after explicit installation.

Mechanism

Explicit remote skill download/clone followed by writes or symlinks into AI-agent skill directories.

Rationale

This is not malicious source behavior: there are no npm install hooks or hidden automatic payload actions. It warrants a warning because explicit remote-content installation into broad AI-agent skill directories is a dangerous capability whose safety depends on the selected source.

Evidence

package.jsonbin/bfi.mjsdist/cli.mjsdist/_chunks/agents.mjs~/.bfi/config.json~/.bfi/agents-cache.json.agents/skills

Network endpoints4

bfi.yyuap.com:811api.github.comraw.githubusercontent.comgit.yyrd.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli.mjs` implements explicit `add`/`skills add` installation commands.
`dist/cli.mjs` maps many AI-agent skill directories, including global home-directory locations.
Install code downloads/clones selected remote skill sources and writes or symlinks their files into agent skill directories.
`dist/cli.mjs` can launch a selected local AI-agent CLI only through the explicit `skills use` command.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` hook; `prepublishOnly` only builds before publishing.
`bin/bfi.mjs` only enables Node compile cache and imports the CLI.
The entrypoint dispatches actions from user-provided command arguments; no default install or agent mutation occurs with no command.
Network access is used for the documented SkillHub/GitHub skill-management workflow.
No credential harvesting, hidden exfiltration, eval/Function use, or destructive behavior was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 13 file(s), 496 KB of source, external domains: api.github.com, bfi.yyuap.com, connectors-skills.zapier.com, example.com, github.com, gitlab.com, raw.githubusercontent.com, schemas.agentskills.io, skillhub.example.com, skillhub.skillhub.woa.com, skills.sh

Source & flagged code

3 flagged

dist/_chunks/libs/simple-git.mjsView file

Lines 1-26javascript

1import { __toESM } from "../rolldown-runtime.mjs";

2import { require_dist, require_src } from "./@kwsites/file-exists.mjs";

3import { c, o, r } from "./@simple-git/args-pathspec.mjs";

4import { require_dist as require_dist$1 } from "./@kwsites/promise-deferred.mjs";

5import { ne } from "./@simple-git/argv-parser.mjs";

6import { normalize } from "node:path";

7import { spawn } from "child_process";

8import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L6

9var import_dist = require_dist();

10var import_src = /* @__PURE__ */ __toESM(require_src(), 1);

11var import_dist$1 = require_dist$1();

12var __defProp = Object.defineProperty;

13var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

14var __getOwnPropNames = Object.getOwnPropertyNames;

15var __hasOwnProp = Object.prototype.hasOwnProperty;

16var __esm = (fn, res) => function __init() {

17 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

18};

19var __commonJS = (cb, mod) => function __require() {

20 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

21};

22var __export = (target, all) => {

23 for (var name in all) __defProp(target, name, {

24 get: all[name],

25 enumerable: true

26 });

dist/cli.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { __exportAll, __toESM } from "./_chunks/rolldown-runtime.mjs";

3import { isCancel } from "./_chunks/libs/@clack/core.mjs";

4import { cancel, confirm, groupMultiselect, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";

5import { require_picocolors } from "./_chunks/libs/picocolors.mjs";

6import

Source & flagged code

3 flagged · loading source

dist/_chunks/libs/simple-git.mjsView file

6import { normalize } from "node:path"; L7: import { spawn } from "child_process"; L8: import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L6

dist/cli.mjsView file

17import { Writable } from "stream"; L18: import https from "node:https"; L19: import http from "node:http"; ... L22: import { promisify } from "util"; L23: import { execFile, execSync, spawn, spawnSync } from "child_process"; L24: import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises"; ... L28: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1); L29: const GIT_HOST = process.env.BFI_GIT_HOST || "git.yyrd.com"; L30: const GIT_URL = `https://${GIT_HOST}`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L17

17Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution. L17: import { Writable } from "stream"; L18: import https from "node:https"; L19: import http from "node:http"; L20: import os$1 from "node:os"; L21: import zlib, { gunzipSync, inflateRawSync } from "node:zlib"; L22: import { promisify } from "util"; L23: import { execFile, execSync, spawn, spawnSync } from "child_process"; L24: import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises"; ... L28: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1); L29: const GIT_HOST = process.env.BFI_GIT_HOST || "git.yyrd.com"; L30: const GIT_URL = `https://${GIT_HOST}`; ... L63: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L17

Findings

4 High3 Medium5 Low

HighChild Processdist/_chunks/libs/simple-git.mjs

HighShell

HighSame File Env Network Executiondist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/_chunks/libs/simple-git.mjsView file

Lines 1-26javascript

1import { __toESM } from "../rolldown-runtime.mjs";

2import { require_dist, require_src } from "./@kwsites/file-exists.mjs";

3import { c, o, r } from "./@simple-git/args-pathspec.mjs";

4import { require_dist as require_dist$1 } from "./@kwsites/promise-deferred.mjs";

5import { ne } from "./@simple-git/argv-parser.mjs";

6import { normalize } from "node:path";

7import { spawn } from "child_process";

8import { EventEmitter } from "node:events";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L6

9var import_dist = require_dist();

10var import_src = /* @__PURE__ */ __toESM(require_src(), 1);

11var import_dist$1 = require_dist$1();

12var __defProp = Object.defineProperty;

13var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

14var __getOwnPropNames = Object.getOwnPropertyNames;

15var __hasOwnProp = Object.prototype.hasOwnProperty;

16var __esm = (fn, res) => function __init() {

17 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

18};

19var __commonJS = (cb, mod) => function __require() {

20 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

21};

22var __export = (target, all) => {

23 for (var name in all) __defProp(target, name, {

24 get: all[name],

25 enumerable: true

26 });

dist/cli.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { __exportAll, __toESM } from "./_chunks/rolldown-runtime.mjs";

3import { isCancel } from "./_chunks/libs/@clack/core.mjs";

4import { cancel, confirm, groupMultiselect, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";

5import { require_picocolors } from "./_chunks/libs/picocolors.mjs";

6import