Loading npm security reports…
花生壳CLI - 内网穿透 & 文件托管，支持 Windows/macOS/Linux 多平台
LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically places AI-agent instructions in ~/.hsk/AGENTS.md. The content can guide later use of this CLI, but no foreign agent configuration write or install-time network activity was found.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/hsk-cli.jsView on unpkg · L2Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L4A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
config/agents.jsonView on unpkgThis report applies to @aweray/hsk-cli@0.7.13.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L19Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L19Package source references dynamic require/import behavior.
bin/hsk-cli.jsA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
config/agents.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L4