Loading npm security reports…
(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.
LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package automatically modifies Cursor's global skill control surface. It installs package-controlled skills as globally applied rules and cleans related namespaces.
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/channels/slack/eval-directive.jsView on unpkg · L133Package source references dynamic require/import behavior.
dist/internal/authored-loaders.jsView on unpkg · L44A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/channels.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/agent-serve.jsView on unpkgThis report applies to @cursor/july@0.1.102.
See version security history for other recorded verdicts.
Evidence last updated: .
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg · L234Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L234Package source references dynamic require/import behavior.
dist/internal/authored-loaders.jsView on unpkg · L44A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/channels.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/agent-serve.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/channels/slack/eval-directive.jsView on unpkg · L133