Loading npm security reports…
SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall installs package-owned agent skills into global Claude/Agents skill directories and may create a recurring user-level collector task. The task flushes queued, sanitized KB events to the configured collector.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/cli.jsView on unpkg · L1Source writes installer persistence such as shell profile or service configuration.
dist/cli.jsView on unpkg · L41Package ships non-JavaScript build or shell helper files.
skills/importing-artifacts/scripts/scan_source.pyView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L18Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L18Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/cli.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
skills/importing-artifacts/scripts/scan_source.pyView on unpkgSource writes installer persistence such as shell profile or service configuration.
dist/cli.jsView on unpkg · L41