Loading npm security reports…
Agent Skill operator manual and policy files for Cassie
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically writes an agent skill into home-directory control surfaces. The skill directs supported agents to operate a trading CLI.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe package runs its installer automatically after npm installation.
package.jsonView on unpkg · L36Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.mjsView on unpkg · L3Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
install.mjsView on unpkgThis report applies to @quotient-forecasting/cassie-skill@0.4.7.
See version security history for other recorded verdicts.
Evidence last updated: .
The installer targets both generic and Claude agent skill directories in the user's home directory.
install.mjsView on unpkg · L12It creates directories and overwrites a skill manual and policy directory there.
install.mjsView on unpkg · L26Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L37Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L37The package runs its installer automatically after npm installation.
package.jsonView on unpkg · L36A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe installer targets both generic and Claude agent skill directories in the user's home directory.
install.mjsView on unpkg · L12It creates directories and overwrites a skill manual and policy directory there.
install.mjsView on unpkg · L26Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
install.mjsView on unpkg · L3Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
install.mjsView on unpkg