Loading npm security reports…
The unified framework for building Command Center-compatible resource applications, widgets, workspaces, connections, themes, and embeds.
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall mutates consumer-project AI-agent skill namespaces. With user-supplied MCP configuration, it also retrieves and installs remote platform skills.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall automatically invokes agent-skill installation in the consumer project.
package.jsonView on unpkg · L160Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
cli/install-agent-skills.mjsView on unpkg · L1postinstall automatically invokes agent-skill installation in the consumer project.
cli/postinstall.mjsView on unpkg · L54Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L160Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L160postinstall automatically invokes agent-skill installation in the consumer project.
package.jsonView on unpkg · L160Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
cli/install-agent-skills.mjsView on unpkg · L1postinstall automatically invokes agent-skill installation in the consumer project.
cli/postinstall.mjsView on unpkg · L54