Loading npm security reports…
观远工作流数据流编辑工具 - 创建、编辑、导出、预览、保存数据流
LPM treats this as warn-only first-party agent extension lifecycle risk. Global installation automatically installs a package-owned AI skill through npx and copies it into assistant skill directories. Removing WorkBuddy's safe-delete preload adds unresolved protection-bypass risk, but no active malicious attack was established.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json automatically invokes bin/postinstall.js after installation.
package.jsonView on unpkg · L9The hook runs only for global installs outside CI, unless explicitly skipped.
bin/postinstall.jsView on unpkg · L23The hook invokes the install-skill command, which uses npx to install the package-owned guanwf skill globally.
bin/postinstall.jsView on unpkg · L37This report applies to @guandata/guanwf@0.1.835.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L9package.json automatically invokes bin/postinstall.js after installation.
package.jsonView on unpkg · L9The hook runs only for global installs outside CI, unless explicitly skipped.
bin/postinstall.jsView on unpkg · L23The hook invokes the install-skill command, which uses npx to install the package-owned guanwf skill globally.
bin/postinstall.jsView on unpkg · L37