registry / @skylence-ai/skyline / 1.0.72

@skylence-ai/skyline@1.0.72

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time execution automatically runs `skyline setup` through a package-aligned platform binary. The binary payload is not included here, so its setup-side effects cannot be established by source inspection.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall when not running in CI and `SKYLINE_NO_AUTO_SETUP` is unset

Impact

Potential first-party CLI/MCP extension setup or local configuration mutation; no confirmed exfiltration or destructive behavior.

Mechanism

postinstall delegates to an opaque first-party native setup command

Rationale

The source establishes automatic install-time delegation to an uninspected native `setup` command, but contains no concrete malicious chain. Downgrade to warn until the platform binary’s setup behavior is reviewed.

Evidence

package.jsonpostinstall.jsbin.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` defines `postinstall: node postinstall.js`.
`postinstall.js` automatically invokes `bin.js setup` outside CI unless `SKYLINE_NO_AUTO_SETUP` is set.

@skylence-ai/skyline@1.0.72

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code