registry / @nextsparkjs/ai-workflow / 0.1.0-beta.184

@nextsparkjs/ai-workflow@0.1.0-beta.184

AI workflow templates for NextSpark - Claude Code agents, commands, skills, and multi-editor support

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Postinstall conditionally refreshes a pre-existing Claude Code workflow directory in NextSpark projects. It copies package-owned AI-agent instructions and overwrites designated managed files.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install/update when the consumer has a NextSpark dependency and existing .claude directory

Impact

Changes Claude Code agent instructions and workflow files in the consumer project.

Mechanism

guarded lifecycle sync of first-party AI workflow templates

AI rationale

This is a documented, guarded first-party AI-agent extension lifecycle mutation, not concrete malware. It merits a warning because an install-time hook modifies an AI-agent control surface and overwrites managed instructions.

Evidence

package.jsonscripts/postinstall.mjsscripts/setup.mjsREADME.mdclaude/skills/nextjs-api-development/scripts/generate-crud-tests.py.claude/agents/**.claude/commands/**.claude/skills/**.claude/templates/**.claude/workflows/**.claude/_docs/**.claude/config/*.schema.json.claude/sessions/

@nextsparkjs/ai-workflow@0.1.0-beta.184

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code