@ai-content-space/loopx@0.4.0

One or more suspicious static signals were detected.

npm install postinstall, loopx install-skills, loopx repair-install, or plugin install

Local agent workflow files and Claude hook settings may be changed; installed hooks provide advisory context and version notices.

agent skill/hook installer with optional user-invoked Codex subprocess runner

On install, the lifecycle script copies bundled workflow skills and hook scripts into user agent directories and may register a Claude UserPromptSubmit hook. The hook code reads local loopx workflow state and prints bounded advisory text, plus a best-effort npm registry version check. This is risky agent-surface mutation during install, but source inspection did not show concealed malicious behavior or data exfiltration.

Static inspection supports a warn-level verdict for install-time mutation of AI-agent hooks and a dangerous user-invoked Codex execution helper, but the behavior is documented and package-aligned with no confirmed malicious payload. No publish block is justified from the inspected source.