@bfrs/agentic-components@0.8.4
Shiprocket agentic component library and documentation showcase.
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource inspection confirms automatic agent-file and package-script mutation from the postinstall hook. The observed setup is first-party library context and lint wiring, so it supports a warning for agent extension lifecycle risk rather than a malicious verdict.
Decision evidence
public snapshot- package.json runs scripts/postinstall.cjs automatically during installation.
- The hook runs in a consumer lifecycle and supports an environment-variable skip.
- The hook selects AGENTS.md or CLAUDE.md files and adds a reference to package-provided agent context.
- The installer also adds a lint script and may prepend its command to consumer build scripts.
- The added agent-file text is a library-context reference; inspected source shows no prompt export, credential transfer, or remote agent channel.
Source & flagged code
6 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json runs scripts/postinstall.cjs automatically during installation.
package.jsonView on unpkg · L54Findings
Affected versions and remediation
This report applies to @bfrs/agentic-components@0.8.4.
See all versions of @bfrs/agentic-components for other recorded verdicts.
- Review the evidence and your use of @bfrs/agentic-components@0.8.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.