Loading npm security reports…
Local-first Astro website builder for Claude, Claude Design, Codex, and the command line.
LPM treats this as warn-only first-party agent extension lifecycle risk. A global install automatically adds a first-party Claude Code skill. It replaces the package-named skill directory and launcher under the user's Claude configuration.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
packages/cli/lib/claude-plugin.mjsView on unpkg · L17Its postinstall hook automatically installs a Claude Code plugin during global installation.
scripts/postinstall.mjsView on unpkg · L3This report applies to @archangel70/cosmo@1.7.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L77Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L77Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
packages/cli/lib/claude-plugin.mjsView on unpkg · L17Its postinstall hook automatically installs a Claude Code plugin during global installation.
scripts/postinstall.mjsView on unpkg · L3