registry / AI-agent control-surface risk / focalapi-cli

focalapi-cli

让任意 AI Agent 直接调用 focalapi 创作模型的命令行工具

This report shows the evidence for focalapi-cli@1.1.4. 14 of 28 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

The inspected lifecycle chain performs unconsented postinstall mutation across foreign AI-agent control surfaces, which meets the supplied blocking policy. Transactional writes and package-owned skill content do not remove that automatic broad integration behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation when the skip and CI environment guards are inactive and supported agents are detected.

Impact

Later agent sessions can load unsolicited instructions that route creative tasks through FocalAPI.

Mechanism

The hook launches connect install, which discovers agent directories and installs or replaces bundled FocalAPI skills.

Policy narrative

Installing the package automatically launches its agent integration command. Without a consent prompt, that command selects detected agents and writes bundled skills into their control directories. The routing skill activates for creative tasks even when the user has not requested FocalAPI. Environment opt-outs and package-prefixed skill names limit the behavior but do not authorize automatic mutation of foreign agent control surfaces.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsdist/cli.jsskills/focalapi/SKILL.md.claude/skills.agents/skills.focalapi-managed-skills.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json automatically runs scripts/postinstall.cjs after installation.
The postinstall script invokes connect install without requesting consent.
The CLI targets foreign agent skill directories, including Claude Code, and selects all detected agents by default.
The installer copies bundled skills into those directories and replaces existing matching skill directories.
The installed routing skill directs agents to use FocalAPI even when users do not mention it.

Evidence against

Installed skill names are restricted to the focalapi prefix, and replacement uses transactional backups.
The hook can be disabled through environment settings; the inspected integration performs local filesystem operations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 160 KB of source, external domains: api.focalapi.com, focalapi.com, focalapi.invalid, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 6-46json

6 "bin": {

7 "focalapi": "dist/cli.js"

8 },

9 "files": [

10 "dist",

11 "scripts",

12 "skills",

13 "README.md",

14 "CHANGELOG.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "dev": "tsx src/cli.ts",

22 "build": "tsup",

23 "test": "vitest run",

24 "test:watch": "vitest",

25 "typecheck": "tsc --noEmit",

26 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "prepublishOnly": "npm run build && npm test"

28 },

29 "keywords": [

30 "focalapi",

31 "ai",

32 "agent",

33 "cli",

34 "llm",

35 "image-generation",

36 "video-generation"

37 ],

38 "license": "Apache-2.0",

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/focalapi/focalapi-cli.git"

42 },

43 "homepage": "https://github.com/focalapi/focalapi-cli#readme",

44 "bugs": {

45 "url": "https://github.com/focalapi/focalapi-cli/issues"

46 },

dist/cli.jsView file

Lines 21-61javascript

21 this.status = opts?.status;

22 this.hint = opts?.hint;

23 this.body = opts?.body;

24 this.upstreamCode = opts?.upstreamCode;

25 this.requestId

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

41missing_api_key: "\u672A\u914D\u7F6E API Key\u3002\u8FD0\u884C focalapi auth login --key <sk-...>\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF FOCALAPI_API_KEY\u3002", L42: invalid_api_key: "API Key \u65E0\u6548\u3001\u5DF2\u8FC7\u671F\u6216\u88AB\u5220\u9664\u3002\u524D\u5F80 https://focalapi.com/console/token \u68C0\u67E5\u6216\u65B0\u5EFA Key\uFF0C... L43: insufficient_quota: "\u8D26\u6237\u989D\u5EA6\u4E0D\u8DB3\u3002\u524D\u5F80 https://focalapi.com/console/topup \u5145\u503C\uFF1B\u53EF\u8FD0\u884C focalapi usage \u67E5\u770B\u5F5... ... L84: function isInteractive() { L85: return Boolean(process.stdout.isTTY) && !process.env.CI; L86: } ... L115: function printJson(data) { L116: process.stdout.write(JSON.stringify(sanitize(data), null, 2) + "\n"); L117: } ... L199: function c

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

dist/cli.jsView on unpkg · L41

•Trigger-reachable chain: manifest.bin -> dist/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = focalapi-cli@1.0.5 matchedIdentity = npm:Zm9jYWxhcGktY2xp:1.0.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: missing_api_key: "\u672A\u914D\u7F6E API Key\u3002\u8FD0\u884C focalapi auth login --key <sk-...>\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF FOCALAPI_API_KEY\u3002", invalid_api_key: "API Key \u65E0\u6548\u3001\u5DF2\u8FC7\u671F\u6216\u88AB\u5220\u9664\u3002\u524D\u5F80 https://focalapi.com/console/token \u68C0\u67E5\u6216\u65B0\u5EFA Key\uFF0C... upstream_auth_failed: "\u4E0A\u6E38\u6E20\u9053\u9274\u6743\u5931\u8D25\uFF0C\u5E76\u4E0D\u8868\u793A\u4F60\u7684 FocalAPI Key \u65E0\u6548\u3002\u5148\u8FD0\u884C focalapi auth st... if (/api[-_]?key|authorization|token/i.test(k) && typeof v === "string") { import { createI

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

Findings

3 Critical2 High4 Medium5 Low

CriticalDns Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to focalapi-cli@1.1.4.

The versions list below shows the verdict for each recorded version.

Avoid installing focalapi-cli@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 15:25:26.193Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

28 known versions

98%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

Version1.1.4

PublishedSep 20, 2026

LicenseApache-2.0

Dependencies1

Integrityverified

Package size65.6 KB

Files13

Keywordsfocalapiaiagentclillmimage-generationvideo-generation

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → focalapi

Runtimenode >=18

Artifact226 KB · 13 files2 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Source & flagged code

Related packages

Other AI-agent control-surface risk packages