Loading npm security reports…

focalapi-cli@1.1.1: AI-agent control-surface risk | LPM Firewall

registry / focalapi-cli / 1.1.1

focalapi-cli@1.1.1

让任意 AI Agent 直接调用 focalapi 创作模型的命令行工具

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook automatically installs behavioral instructions into multiple foreign AI agents' skill directories. No consent prompt guards this installation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing the package with lifecycle scripts enabled, outside the configured skip conditions, when supported agents are detected.

Impact

Later agent sessions can adopt routing instructions that direct creative tasks through FocalAPI without the user having requested that integration.

Mechanism

The hook invokes connect install, which detects agent directories and installs or replaces bundled FocalAPI skills.

Policy narrative

Installation launches the bundled CLI skill installer automatically. It detects supported agents and writes bundled instructions into their skill directories without a consent prompt. The installed router expands activation to creative tasks where the user never mentions FocalAPI. Subsequent installations can replace those skills automatically. This is an install-time change to foreign agent control surfaces, regardless of the skills' package-specific names.

AI rationale

Inspected source establishes unconsented postinstall mutation of multiple foreign AI-agent instruction surfaces, meeting the blocking policy. The decision rests on that executable installation chain, not the unsupported gateway scanner hint.

Evidence

package.jsonscripts/postinstall.cjsdist/cli.jsskills/focalapi/SKILL.md.claude/skills.agents/skills.focalapi-managed-skills.json

Source & flagged code

4 flagged

package.jsonView file

Lines 6-46json

6 "bin": {

7 "focalapi": "dist/cli.js"

8 },

9 "files": [

10 "dist",

11 "scripts",

12 "skills",

13 "README.md",

14 "CHANGELOG.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "dev": "tsx src/cli.ts",

22 "build": "tsup",

23 "test": "vitest run",

24 "test:watch": "vitest",

25 "typecheck": "tsc --noEmit",

26 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "prepublishOnly": "npm run build && npm test"

28 },

29 "keywords": [

30 "focalapi",

31 "ai",

32 "agent",

33 "cli",

34 "llm",

35 "image-generation",

36 "video-generation"

37 ],

38 "license": "Apache-2.0",

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/focalapi/focalapi-cli.git"

42 },

43 "homepage": "https://github.com/focalapi/focalapi-cli#readme",

44 "bugs": {

45 "url": "https://github.com/focalapi/focalapi-cli/issues"

46 },

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: missing_api_key: "\u672A\u914D\u7F6E API Key\u3002\u8FD0\u884C focalapi auth login --key <sk-...>\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF FOCALAPI_API_KEY\u3002", invalid_api_key: "API Key \u65E0\u6548\u3001\u5DF2\u8FC7\u671F\u6216\u88AB\u5220\u9664\u3002\u524D\u5F80 https://focalapi.com/console/token \u68C0\u67E5\u6216\u65B0\u5EFA Key\uFF0C... upstream_auth_failed: "\u4E0A\u6E38\u6E20\u9053\u9274\u6743\u5931\u8D25\uFF0C\u5E76\u4E0D\u8868\u793A\u4F60\u7684 FocalAPI Key \u65E0\u6548\u3002\u5148\u8FD0\u884C focalapi auth st... if (/api[-_]?key|authorization|token/i.test(k) && typeof v === "string") { import { createI

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = focalapi-cli@1.0.5 matchedIdentity = npm:Zm9jYWxhcGktY2xp:1.0.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg