registry / @skylence-ai/skyline / 1.0.74

@skylence-ai/skyline@1.0.74

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The install hook invokes `skyline setup`, which documentation says configures a Skyline daemon and agent plugins. The wrapper source itself contains no confirmed network, harvesting, or destructive behavior.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs without `CI` or `SKYLINE_NO_AUTO_SETUP`; alternatively a user runs `skyline setup`.

Impact

May alter local Skyline-owned service and agent-plugin configuration; the platform binary implementation is not present in this package.

Mechanism

postinstall-triggered first-party daemon and AI-agent plugin setup via platform binary

Rationale

Source supports a real install-time first-party agent-extension/daemon setup risk, not a concrete malicious chain. The scanner fingerprint alone is insufficient to block this package.

Evidence

package.jsonpostinstall.jsbin.jsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` defines `postinstall`.

@skylence-ai/skyline@1.0.74

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code