registry / novel-agent-cli / 3.0.1

novel-agent-cli@3.0.1

AI Novel Agent v3.0.1 — Story Bible Graph × Character Agent×N × Timeline Synthesis × Review Agent (deAI/expand/rewrite/repair) × 4-stage pipeline. Terminal-based Chinese web novel creation assistant. New: review_repair tool + novel-rewrite-fix Skill for d

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface is present in the shipped files. The install hook has no bundled binary to copy and performs no network or agent-control mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall or an explicit novel-agent command

Impact

No package-provided payload executes from this archive.

Mechanism

missing-payload CLI launcher with user-invoked local binary execution

Rationale

The lifecycle hook is a package-aligned CLI installer, but this archive lacks its dist payload, so it only logs a dev-mode message. Static inspection found no concrete malicious chain or foreign AI-agent control-surface mutation.

Evidence

package.jsoninstall.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall
install.js can copy a dist binary into npm's bin directory
install.js executes a discovered binary only on user CLI invocation

Evidence against

Package contains only package.json, install.js, and README.md; no dist/ payload exists

novel-agent-cli@3.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code