Loading npm security reports…
花生壳CLI - 内网穿透 & 文件托管，支持 Windows/macOS/Linux 多平台
LPM treats this as warn-only first-party agent extension lifecycle risk. Installation writes a package-owned instruction file in ~/.hsk. A later successful context wizard silently installs this package's skill into existing third-party AI-agent directories; runtime commands can fetch and execute a native binary.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/hsk-cli.jsView on unpkg · L2Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L4A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
config/agents.jsonView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/commands/tunnel.jsView on unpkgThis report applies to @aweray/hsk-cli@0.7.11.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/hsk-cli.jsView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
config/agents.jsonView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/commands/tunnel.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L4