@splashtop/app-runner-cli@0.1.9

No blocking static signals were detected.; previous stored version diff introduced dangerous source

User runs `app-runner init <name>` or another CLI subcommand.

A user-invoked scaffold can add auto-discovered Claude guidance to the new project; no unconsented install-time mutation or concrete exfiltration chain is present.

Explicit scaffold-time AI-agent configuration write and authenticated control-plane CLI operations.

This is an explicit user-command agent configuration mutation, which warrants a warning under the stated policy, but source inspection found no concrete malicious behavior. Network and child-process use are tied to the CLI’s documented authenticated deployment workflow.