registry / @customerio/cli / 0.0.22

@customerio/cli@0.0.22

Agent-first CLI for Customer.io APIs

AI Security Review

scanned 14d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall automatically launches the optional Customer.io platform binary to install an agent skill. It targets global or invoking-project scope; the included wrapper does not itself show the resulting writes.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation of @customerio/cli

Impact

May add a Customer.io bootstrap skill under agent configuration directories without an explicit CLI command.

Mechanism

postinstall-triggered first-party agent skill installation

Rationale

This is a documented first-party agent-extension setup, not a demonstrated malicious chain, but it is automatically invoked at install time and affects agent configuration locations. Treat it as a lifecycle risk requiring a warning.

Evidence

package.json.npm/postinstall.jsREADME.mdbin/cio~/.claude~/.agents./.claude./.agents

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Install-time postinstall hook executes automatically.

@customerio/cli@0.0.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code