registry / @guandata/guanmetric / 0.1.10

@guandata/guanmetric@0.1.10

观远 BI 指标写操作工具 - 指标创建编辑删除、指标目录、公共维度、Excel 标准化

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A global npm installation automatically installs this package's AI skill into assistant configuration locations. No confirmed credential theft, remote payload execution, or destructive attack was established from the inspected JavaScript.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing or upgrading the package globally without the skip setting and outside CI.

Impact

This changes AI-agent extension state without an explicit follow-up command, creating a scoped agent-extension lifecycle risk.

Mechanism

The post-install hook runs the CLI install-skill command, which calls the skills installer globally and copies the bundled skill to CodeBuddy and WorkBuddy directories.

AI rationale

Automatic global post-install mutation of AI-agent skill locations is a real lifecycle risk, even though the observed behavior is scoped and guarded. The inspected source does not establish a concrete attack.

Evidence

package.jsonbin/postinstall.jsbin/run.js.codebuddy/skills/guanmetric.workbuddy/skills/guanmetric

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

@guandata/guanmetric@0.1.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code