@eternalnight/publish-kit@0.5.2
Release playbook for AI agents. npm-installable CLI + DSH plugin + skill bundle. Covers npm, GitHub+Gitee dual remote, DSH marketplace, cargo crates.io, PyPI, PyInstaller exe, Go single-binary, Rust single-binary, Electron/Tauri desktop. Bilingual EN/ZH.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe install hook automatically adds this package's own skill to several agent skill roots, which fits the warning category for first-party package-owned agent extension setup. The inspected behavior does not establish a concrete malicious attack.
Decision evidence
public snapshot- package.json runs scripts/postinstall.js automatically after installation.
- The postinstall targets skill directories for five agent tools under the user's home directory.
- It creates a junction to the package's bundled publish-kit skill in each target directory.
- The package has a force option that can replace existing links or directories; this creates a lifecycle extension-registration risk.
- Without force, the script skips existing links, junctions, and real directories.
- The inspected postinstall code only registers this package's bundled skill; no network endpoint or broader agent configuration write was found.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json runs scripts/postinstall.js automatically after installation.
package.jsonView on unpkg · L62Findings
Affected versions and remediation
This report applies to @eternalnight/publish-kit@0.5.2.
See all versions of @eternalnight/publish-kit for other recorded verdicts.
- Review the evidence and your use of @eternalnight/publish-kit@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.