Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

scene-capability-engine@3.7.1: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as AI-agent capability risk

Allowed by default with warning: agent-facing configuration or capability changes need review before use.

View on npm All versions Policy details

registry / scene-capability-engine / 3.7.1

scene-capability-engine@3.7.1

SCE compatibility and migration CLI for moving existing projects to MagicBall DSL.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `sce orchestrate run` with project specs.

Impact

A prompted sub-agent can modify the selected project and other locally accessible files without approval.

Mechanism

User-invoked autonomous Codex subprocess with danger-full-access.

Rationale

The package is not proven malicious, but its explicit orchestration feature materially lowers AI-agent execution safeguards and accesses local authentication material. Publish with a warning rather than block because activation is user-commanded and no concrete exfiltration or stealth persistence chain was found.

Evidence

package.jsonbin/sce.jsbin/scene-capability-engine.jslib/orchestrator/agent-spawner.jslib/commands/orchestrate.jslib/commands/adopt.jslib/auto/governance-advisory-service.jstemplate/.sce/tools/quality_scorer.py.sce/specs.sce/config/orchestrator.json.sce/settings/mcp.json~/.codex/auth.json

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`lib/orchestrator/agent-spawner.js` reads `CODEX_API_KEY` or `~/.codex/auth.json`.
`lib/orchestrator/agent-spawner.js` spawns `codex exec --full-auto --sandbox danger-full-access` with approvals disabled.
`lib/commands/orchestrate.js` reaches the spawner only through explicit `sce orchestrate run` command flow.
`lib/commands/adopt.js` can create package-owned `.sce/settings/mcp.json` enabling `run_process` after explicit adoption.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare`; only `prepublishOnly`.
No hard-coded network host, credential exfiltration path, or install-time execution was found in inspected entrypoints.
`template/.sce/tools/quality_scorer.py` is a plain scoring helper with no subprocess or network use.
The flagged advisory file's leading invisible character is a BOM; its code only delegates recovery actions through injected dependencies.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 423 file(s), 6.23 MB of source, external domains: git-scm.com, github.com, raw.githubusercontent.com, upservice.cc

Source & flagged code

6 flagged · loading source

bin/sce.jsView file

5const requestsVersion = args.includes('--version') || args.includes('-V'); L6: const packageJson = require('../package.json'); L7:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sce.jsView on unpkg · L5

lib/auto/governance-advisory-service.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>async function [redacted](projectPath, options = {}, dependencies = {}) {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/auto/governance-advisory-service.jsView on unpkg · L3

•Trigger-reachable chain: manifest.bin -> bin/sce.js -> bin/scene-capability-engine.js -> lib/commands/auto.js -> lib/auto/governance-advisory-service.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/auto/governance-advisory-service.jsView on unpkg

template/.sce/tools/quality_scorer.pyView file

•path = template/.sce/tools/quality_scorer.py kind = payload_in_excluded_dir sizeBytes = 11862 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.sce/tools/quality_scorer.pyView on unpkg

•path = template/.sce/tools/quality_scorer.py kind = build_helper sizeBytes = 11862 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.sce/tools/quality_scorer.pyView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Findings

2 Critical2 High5 Medium5 Low

CriticalTrojan Source Unicodelib/auto/governance-advisory-service.js

CriticalTrigger Reachable Dangerous Capabilitylib/auto/governance-advisory-service.js

HighPayload In Excluded Dirtemplate/.sce/tools/quality_scorer.py

HighNode Builtin Dependency Squatpackage.json

MediumDynamic Requirebin/sce.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplate/.sce/tools/quality_scorer.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

Authorheguangyong

Maintainersheguangyong

Version3.7.1

PublishedJul 18, 2026

LicenseMIT

Dependencies11

Integrityverified

Package size1.84 MB

Files757

KeywordsSCEspecspec-drivenenginesteeringrules-enginedevelopmentquality

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → index.jsbin → sce, sco

Runtimenode >=16.0.0python >=3.8.0

Artifact8.21 MB · 757 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

bin/sce.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

3const args = process.argv.slice(2);

4const command = args[0];

5const requestsVersion = args.includes('--version') || args.includes('-V');

6const packageJson = require('../package.json');

7

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sce.jsView on unpkg · L5

8require('../lib/transition/magicball-transition').displayFirstRunTransitionNotice({

9 version: packageJson.version,

10 args

11});

12

13if (requestsVersion) {

14 console.log(packageJson.version);

15} else if (command === 'transition' || command === 'migrate-to-magicball') {

16 const transitionCommand = require('../lib/commands/transition');

17 transitionCommand({ json: args.includes('--json') });

18} else {

19 require('./scene-capability-engine');

20}

21

lib/auto/governance-advisory-service.jsView file

Lines 1-23javascript

1const { resolveLatestRecoverableBatchSummary, resolveLatestPendingControllerSession } = require('./recovery-selection-service');

2

3async function executeGovernanceAdvisoryRecover(projectPath, options =

template/.sce/tools/quality_scorer.pyView file

•path = template/.sce/tools/quality_scorer.py kind = payload_in_excluded_dir sizeBytes = 11862 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.sce/tools/quality_scorer.pyView on unpkg

•path = template/.sce/tools/quality_scorer.py kind = build_helper sizeBytes = 11862 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.sce/tools/quality_scorer.pyView on unpkg

package.jsonView file

Lines 6-46json

6 "bin": {

7 "sce": "bin/sce.js",

8 "sco": "bin/sco.js"

9 },

10 "files": [

11 "bin/",

12

{},

dependencies

=

{}) {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/auto/governance-advisory-service.jsView on unpkg · L3

4 const {

5 normalizeGovernanceAdvisoryRecoverMaxRounds,

6 loadCloseLoopBatchSummaryPayload,

7 resolveRecoveryMemoryScope,

8 executeCloseLoopRecoveryCycle,

9 readCloseLoopBatchSummaryEntries,

10 buildCloseLoopBatchGoalsFromSummaryPayload

11 } = dependencies;

12 const recoverMaxRounds = normalizeGovernanceAdvisoryRecoverMaxRounds(options.recoverMaxRounds, 3);

13 const dryRun = Boolean(options.dryRun);

14 const summaryCandidate = typeof options.summary === 'string' && options.summary.trim()

15 ? options.summary.trim()

16 : 'latest';

17 const explicitSummary = summaryCandidate.toLowerCase() !== 'latest';

18 let sourceSummary = null;

19

20 if (explicitSummary) {

21 try {

22 sourceSummary = await loadCloseLoopBatchSummaryPayload(projectPath, summaryCandidate);

23 } catch (error) {

•Trigger-reachable chain: manifest.bin -> bin/sce.js -> bin/scene-capability-engine.js -> lib/commands/auto.js -> lib/auto/governance-advisory-service.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/auto/governance-advisory-service.jsView on unpkg

"lib/"

,

13 "scripts/",

14 "template/",

15 "!template/.sce/tools/__pycache__/",

16 "!template/.sce/tools/**/*.pyc",

17 "!template/.sce/tools/**/*.pyo",

18 "!template/.sce/tools/**/*.pyd",

19 "locales/",

20 "docs/",

21 "README.md",

22 "README.zh.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L26

27 "test": "npx jest",

28 "test:smoke": "npm run test:ci",

29 "test:full": "npx jest --config=jest.config.js",

30 "test:ci": "npx jest --config=jest.config.ci.js",

31 "test:unit": "npx jest tests/unit",

32 "test:integration": "npx jest tests/integration",

33 "test:release": "npm run test:integration -- --runInBand",

34 "test:properties": "npx jest tests/properties",

35 "test:orchestrator-429": "npx jest tests/orchestrator/orchestration-engine.test.js tests/orchestrator/orchestrate-command.status-events.test.js --runInBand",

36 "test:handles": "npx jest --config=jest.config.js --runInBand --detectOpenHandles",

37 "test:interactive-loop-smoke": "node scripts/interactive-loop-smoke.js --json",

38 "test:interactive-flow-smoke": "node scripts/interactive-flow-smoke.js --json",

39 "test:skip-audit": "node scripts/check-skip-allowlist.js",

40 "test:sce-tracking": "node scripts/check-sce-tracking.js",

41 "gate:npm-runtime-assets": "node scripts/npm-package-runtime-asset-check.js --fail-on-violation",

42 "gate:release-posture": "node scripts/release-posture-report.js --require-stable --fail-on-blocking --json",

43 "test:brand-consistency": "node scripts/check-branding-consistency.js",

44 "audit:release-docs": "node scripts/release-doc-version-audit.js --fail-on-error",

45 "audit:refactor-trigger": "node scripts/refactor-trigger-audit.js",

46 "audit:steering": "node scripts/steering-content-audit.js --fail-on-error",