Loading npm security reports…
Agent Skill operator manual and policy files for Cassie
LPM flags this version as an AI-agent control-surface risk. Installation silently mutates two global AI-agent skill control surfaces. It force-copies behavior-bearing skill content into Codex- and Claude-style directories.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgnpm postinstall executes install.mjs automatically.
package.jsonView on unpkg · L31Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.mjsView on unpkg · L3Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
install.mjsView on unpkgInstaller targets both ~/.agents/skills and ~/.claude/skills.
install.mjsView on unpkg · L12Installer creates cassie directories and force-overwrites SKILL.md and thesis.
install.mjsView on unpkg · L26Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L32Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L32npm postinstall executes install.mjs automatically.
package.jsonView on unpkg · L31Installer targets both ~/.agents/skills and ~/.claude/skills.
install.mjsView on unpkg · L12Installer creates cassie directories and force-overwrites SKILL.md and thesis.
install.mjsView on unpkg · L26Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.mjsView on unpkg · L3Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
install.mjsView on unpkg