registry / @guandata/guanvis / 0.1.42

@guandata/guanvis@0.1.42

观远 BI Card/Page 生成工具 - 通过 JS DSL 创建图表和仪表板

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Guarded global installation automatically installs the package-owned AI skill. Removing a WorkBuddy safety preload creates additional unresolved lifecycle risk, but inspected source does not establish a malicious attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A global npm installation outside CI without GUAN_SKIP_INSTALL_SKILL=1, or an explicit install-skill command.

Impact

Assistant skill content can be installed or overwritten automatically, and installation child processes run without that preload.

Mechanism

The launcher invokes npx skills add and copies its skill into assistant directories, using an environment with the WorkBuddy safe-delete preload removed.

AI rationale

The source establishes guarded automatic setup of a package-owned agent extension, with additional risk from disabling a safety preload. This supports a warning rather than a malware block.

Evidence

package.jsonbin/postinstall.jsbin/run.jsbin/install-env.js.codebuddy.workbuddy

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

@guandata/guanvis@0.1.42

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code