Loading npm security reports…

focalapi-cli@1.1.4: AI-agent control-surface risk | LPM Firewall

registry / focalapi-cli / 1.1.4

focalapi-cli@1.1.4

让任意 AI Agent 直接调用 focalapi 创作模型的命令行工具

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook automatically writes routing instructions into multiple foreign AI-agent skill directories without consent. This establishes a concrete agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation when the skip and CI environment guards are inactive and supported agents are detected.

Impact

Later agent sessions can load unsolicited instructions that route creative tasks through FocalAPI.

Mechanism

The hook launches connect install, which discovers agent directories and installs or replaces bundled FocalAPI skills.

Policy narrative

Installing the package automatically launches its agent integration command. Without a consent prompt, that command selects detected agents and writes bundled skills into their control directories. The routing skill activates for creative tasks even when the user has not requested FocalAPI. Environment opt-outs and package-prefixed skill names limit the behavior but do not authorize automatic mutation of foreign agent control surfaces.

AI rationale

The inspected lifecycle chain performs unconsented postinstall mutation across foreign AI-agent control surfaces, which meets the supplied blocking policy. Transactional writes and package-owned skill content do not remove that automatic broad integration behavior.

Evidence

package.jsonscripts/postinstall.cjsdist/cli.jsskills/focalapi/SKILL.md.claude/skills.agents/skills.focalapi-managed-skills.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

41missing_api_key: "\u672A\u914D\u7F6E API Key\u3002\u8FD0\u884C focalapi auth login --key <sk-...>\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF FOCALAPI_API_KEY\u3002", L42: invalid_api_key: "API Key \u65E0\u6548\u3001\u5DF2\u8FC7\u671F\u6216\u88AB\u5220\u9664\u3002\u524D\u5F80 https://focalapi.com/console/token \u68C0\u67E5\u6216\u65B0\u5EFA Key\uFF0C... L43: insufficient_quota: "\u8D26\u6237\u989D\u5EA6\u4E0D\u8DB3\u3002\u524D\u5F80 https://focalapi.com/console/topup \u5145\u503C\uFF1B\u53EF\u8FD0\u884C focalapi usage \u67E5\u770B\u5F5... ... L84: function isInteractive() { L85: return Boolean(process.stdout.isTTY) && !process.env.CI; L86: } ... L115: function printJson(data) { L116: process.stdout.write(JSON.stringify(sanitize(data), null, 2) + "\n"); L117: } ... L199: function c

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

dist/cli.jsView on unpkg · L41

•Trigger-reachable chain: manifest.bin -> dist/cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = focalapi-cli@1.0.5 matchedIdentity = npm:Zm9jYWxhcGktY2xp:1.0.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: missing_api_key: "\u672A\u914D\u7F6E API Key\u3002\u8FD0\u884C focalapi auth login --key <sk-...>\uFF0C\u6216\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF FOCALAPI_API_KEY\u3002", invalid_api_key: "API Key \u65E0\u6548\u3001\u5DF2\u8FC7\u671F\u6216\u88AB\u5220\u9664\u3002\u524D\u5F80 https://focalapi.com/console/token \u68C0\u67E5\u6216\u65B0\u5EFA Key\uFF0C... upstream_auth_failed: "\u4E0A\u6E38\u6E20\u9053\u9274\u6743\u5931\u8D25\uFF0C\u5E76\u4E0D\u8868\u793A\u4F60\u7684 FocalAPI Key \u65E0\u6548\u3002\u5148\u8FD0\u884C focalapi auth st... if (/api[-_]?key|authorization|token/i.test(k) && typeof v === "string") { import { createI

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg