Loading npm security reports…
Personal Claude Code + Codex skills, agents, MCP servers, and global instructions. Symlinks into a canonical ~/.agents store (and ~/.claude) on install.
LPM treats this as warn-only first-party agent extension lifecycle risk. A global npm install automatically adds package and third-party skills to shared AI-agent directories. This changes the instruction/control surface consumed across projects.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/link.mjsView on unpkg · L7Package source invokes a package manager install command at runtime.
scripts/link.mjsView on unpkg · L10Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L25Package source invokes a package manager install command at runtime.
scripts/link.mjsView on unpkg · L10Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/link.mjsView on unpkg · L7