Loading npm security reports…
Agent-first CLI for Customer.io APIs
LPM flags this version as an AI-agent control-surface risk. Installation automatically invokes an agent-skills installer. It selects global scope for global installs and project scope otherwise.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package registers a postinstall lifecycle hook.
package.jsonView on unpkg · L5Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe hook automatically runs the platform binary's skills-install command with global or project scope and targets the installing project's directory.
.npm/postinstall.jsView on unpkg · L46The hook automatically runs the platform binary's skills-install command with global or project scope and targets the installing project's directory.
.npm/postinstall.jsView on unpkg · L50The package text identifies the command as installing agent skills into Claude and open-agent skill locations.
README.mdView on unpkg · L38This report applies to @customerio/cli@0.0.28.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9The package registers a postinstall lifecycle hook.
package.jsonView on unpkg · L5The hook automatically runs the platform binary's skills-install command with global or project scope and targets the installing project's directory.
.npm/postinstall.jsView on unpkg · L46The hook automatically runs the platform binary's skills-install command with global or project scope and targets the installing project's directory.
.npm/postinstall.jsView on unpkg · L50The package text identifies the command as installing agent skills into Claude and open-agent skill locations.
README.mdView on unpkg · L38