registry / redsea-cli / 0.2.0

redsea-cli@0.2.0

红海云企业数据与接口统一 CLI(redsea-cli)

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies user-wide skill directories for multiple AI-agent products. It replaces skill content with files shipped by this package.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

Package installation changes AI-agent instructions across the user's environment without an explicit setup command.

Mechanism

Automatic cross-agent skill installation and replacement

Policy narrative

The package declares postinstall, which runs its own CLI with skill install. With no target option, that command deletes and recreates package-named skills in user-wide .agents, .claude, and .codex directories. This is an unconsented install-time mutation of broad AI-agent control surfaces, so later agent sessions can consume package-controlled instructions.

AI rationale

The automatic postinstall path performs broad user-level AI-agent configuration mutation and destructive replacement without explicit user setup. This meets the install-hook abuse policy even though the lifecycle path does not itself make network requests.

Evidence

package.jsonscripts/postinstall.mjsdist/commands/skill.js~/.agents/skills/redsea-data~/.agents/skills/redsea-api~/.claude/skills/redsea-data~/.claude/skills/redsea-api~/.codex/skills/redsea-data~/.codex/skills/redsea-api

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The postinstall lifecycle hook automatically runs the CLI skill installer.
The default installer targets three user-wide AI-agent skill directories without user selection.
The installer recursively removes existing skill directories and writes package-supplied files into them.

Evidence against

No runtime dependency on redsea-cli itself is declared.
No network request is made by the postinstall path itself.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 17 file(s), 43.8 KB of source, external domains: 127.0.0.1, vw.hr-soft.cn

Source & flagged code

5 flagged

package.jsonView file

Lines 4-35json

4 "description": "红海云企业数据与接口统一 CLI(redsea-cli)",

5 "license": "UNLICENSED",

6 "type": "module",

7 "bin": {

8 "redsea": "dist/index.js"

9 },

10 "files": [

11 "dist",

12 "skills",

13 "scripts"

14 ],

15 "publishConfig": {

16 "access": "public"

17 },

18 "engines": {

19 "node": ">=18"

20 },

21 "scripts": {

22 "build": "tsc",

23 "dev": "tsc --watch",

24 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build"

26 },

27 "dependencies": {

28 "commander": "^12.1.0"

29 },

30 "devDependencies": {

31 "@types/node": "^20.14.0",

32 "typescript": "^5.5.0"

33 }

34}

dist/commands/skill.jsView file

Lines 1-22javascript

1// Skill 安装器:把 redsea-cli 的使用说明安装到 AI 编程工具

2// 默认全局安装(装一次,所有项目、所有智能体可用),覆盖三个通用技能目录:

3// ~/.agents/skills/<技能名>/ 跨智能体通用技能目录(飞书 CLI 等同类工具也装在这里)

4// ~/.claude/skills/<技能名>/ Claude Code 用户级技能

5// ~/.codex/skills/<技能名>/ Codex 用户级技能

6// 升级 CLI 后重新执行 redsea skill install 即可原地更新

7import fs from 'node:fs';

8import os from

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/skill.jsView file

2Install-time code directly mutates a foreign AI-agent control surface: L2: // 默认全局安装(装一次,所有项目、所有智能体可用),覆盖三个通用技能目录: L3: // ~/.agents/skills/<技能名>/ 跨智能体通用技能目录(飞书 CLI 等同类工具也装在这里) L4: // ~/.claude/skills/<技能名>/ Claude Code 用户级技能 L5: // ~/.codex/skills/<技能名>/ Codex 用户级技能 L6: // 升级 CLI 后重新执行 redsea skill install 即可原地更新 ... L18: const target = path.join(dir, file.relativePath); L19: fs.mkdirSync(path.dirname(target), { recursive: true }); L20: fs.writeFileSync(target, file.content); L21: console.log(`已写入 ${target}`); ... L29: } L30: // 追加/更新当前项目的 AGENTS.md(用标记块支持重复安装时原地覆盖) L31: function installAgentsMd() { Write operation from dist/config.js: L60: } L61: fs.mkdirSync(CONFIG_DIR, { recursive: true }); L62: const f = readUserFile(CONFIG_FILE); L63: f.env = name; L64: fs.writeFile

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/commands/skill.jsView on unpkg · L2

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: in(legacy, 'skill.md'))) { fs.rmsync(legacy, { recursive: true, force: true }); console.log(`已清理旧版单技能目录 ${legacy}`); } } function installagentsmd() { const file = 'agents.md'; const start = ''; const end = ''; const block = `${start}\n${agentssnippet()}${end}`; const existing = fs.existssync(file) ? fs.readfilesync(file, 'utf8') : ''; if (existing.includes(start) && existing.includes(end)) { const updated = existing.slice(0, existing.indexof(start)) + block + existing.slice(existing.indexof(end) + end.length);

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/skill.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. irsync(path.dirname(target), { recursive: true }); fs.writefilesync(target, file.content); console.log(`已写入 ${target}`); } } const legacy = path.join(skillsroot, 'redsea'); if (fs.existssync(path.join(legacy, 'skill.md'))) { fs.rmsync(legacy, { recursive: true, force: true }); console.log(`已清理旧版单技能目录 ${legacy}`); } } function installagentsmd() { const file = 'agents.md'; const start = ''; const end = ''; const block = `${start}\n${agentssnippet()}${end}`; const

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/skill.jsView on unpkg

Findings

1 Critical3 High3 Medium6 Low

CriticalAi Agent Control Hijackdist/commands/skill.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationdist/commands/skill.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/skill.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to redsea-cli@0.2.0.

See version security history for other recorded verdicts.

Avoid installing redsea-cli@0.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-11 09:52:27.490Z (UTC).