Loading npm security reports…
Enterprise Feature-local Spec Package workflow for Claude, Gemini, and Cursor (3A-Factory)
LPM treats this as warn-only first-party agent extension lifecycle risk. The explicit CLI scaffolds packaged workflow prompts and rules into project AI-agent control paths. The postinstall entrypoint exits without making these changes during npm lifecycle execution.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgManifest invokes installer at postinstall.
package.jsonView on unpkg · L27Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/install.jsView on unpkg · L175Package source references dynamic require/import behavior.
dist/install.jsView on unpkg · L10Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg · L27Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L27Manifest invokes installer at postinstall.
package.jsonView on unpkg · L27Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L29Package source references dynamic require/import behavior.
dist/install.jsView on unpkg · L10Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/install.jsView on unpkg · L175