@agent-native/skills
Install BuilderIO skills for coding agents.
This report shows the evidence for @agent-native/skills@0.3.55. 0 of 272 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install hooks, and the executable runs the CLI only when invoked. Network access, telemetry, and agent configuration writes are tied to CLI operations and match the package's stated skill-installer purpose.
Decision evidence
public snapshot- The package has no install lifecycle scripts; its npm scripts are build, typecheck, and test.
- The executable calls runSkillsCli with command-line arguments; the exported library entry does not invoke it automatically.
- GitHub source downloads occur inside the CLI flow and fetch from codeload.github.com.
- The CLI describes its first-party analytics telemetry, reported fields, and opt-out settings.
- Skill files and agent configuration are written by installer functions invoked through explicit CLI operations.
- The package includes child-process, network, filesystem, and environment-variable APIs, but the inspected uses serve CLI installation and source retrieval.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.js#virtual:normalized:round1View on unpkg · L32Findings
Affected versions and remediation
This report applies to @agent-native/skills@0.3.55.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @agent-native/skills@0.3.55 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.