registry / @nextsparkjs/ai-workflow / 0.1.0-beta.185

@nextsparkjs/ai-workflow@0.1.0-beta.185

AI workflow templates for NextSpark - Claude Code agents, commands, skills, and multi-editor support

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package can update an existing NextSpark project's Claude workflow files. The guarded postinstall path overwrites package-managed files in the consumer .claude directory.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation or update in a project with a NextSpark dependency and existing .claude directory.

Impact

Consumer AI-agent instructions and related workflow files can be changed without a separate setup command.

Mechanism

Guarded postinstall execution that copies workflow templates into .claude.

AI rationale

This is a guarded first-party AI workflow auto-sync that mutates consumer agent files during installation. It is a lifecycle risk requiring a warning, not evidence of malware.

Evidence

package.jsonscripts/postinstall.mjsscripts/setup.mjs.claude/agents.claude/commands.claude/skills.claude/templates.claude/workflows.claude/_docs

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

@nextsparkjs/ai-workflow@0.1.0-beta.185

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code