Loading npm security reports…
Claude Code skills for scrum project management — PRD to production release pipeline with project scaffolding, sprint planning, status tracking, sprint releases, full-project emulation testing, autonomous orchestration, and project cleanup.
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall installs this package's Claude skills into ~/.claude/skills for global installs or .claude/skills in the consuming project. This is a first-party agent-extension lifecycle write; no concrete malicious payload or exfiltration was established.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/install.jsView on unpkg · L27Package source references dynamic require/import behavior.
bin/install.jsView on unpkg · L2Installer writes packaged skills into Claude Code's global or project skill directory.
bin/install.jsView on unpkg · L54Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L10Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L10Package text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
bin/install.jsView on unpkg · L27Installer writes packaged skills into Claude Code's global or project skill directory.
bin/install.jsView on unpkg · L54