@customerio/cli@0.0.19

One or more suspicious static signals were detected.

npm install of @customerio/cli@0.0.19

Can write Customer.io agent skill instructions into project or global agent skill directories, influencing future AI-agent behavior without a separate explicit invocation.

postinstall spawns platform binary with skills install --project/--global

On installation, npm runs .npm/postinstall.js. That script resolves the platform-specific optional dependency binary and spawns it as `cio skills install --project` from INIT_CWD, or `--global` for global npm installs. README documents that this command writes SKILL.md routing content into agent skill locations such as .claude and .agents. This is an unconsented lifecycle mutation of AI-agent control files.

The suspicious behavior is not merely a wrapper or package-aligned CLI capability; the lifecycle hook automatically invokes an agent-skill installer during npm install. Under the firewall boundary, unconsented lifecycle AI-agent control-surface mutation is concrete attack behavior. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.