registry / @guandata/guanmetric / 0.1.16

@guandata/guanmetric@0.1.16

观远 BI 指标写操作工具 - 指标创建编辑删除、指标目录、公共维度、Excel 标准化

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A global-install postinstall hook automatically installs an AI skill and copies it into assistant configuration directories. No credential theft or destructive behavior was confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

Global npm installation outside CI without the opt-out setting.

Impact

This changes AI-assistant skill configuration without an explicit follow-up user command.

Mechanism

The hook launches the package command, which uses npx to add its skill globally and copies skill files to named assistant directories.

AI rationale

The package performs a guarded but automatic global AI-agent extension setup during postinstall. This is a concrete lifecycle risk, not evidence of a confirmed malicious payload or exfiltration.

Evidence

package.jsonbin/postinstall.jsbin/run.jsskills/guanmetric

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json defines a postinstall hook.
The hook runs only for global non-CI installs, then invokes install-skill automatically.

@guandata/guanmetric@0.1.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code