Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
User runs the package CLI to install, update, or remove the skill.
Impact
Installs a package-provided agent extension into user-selected project or global agent configuration locations.
Mechanism
Copies/removes bundled architecture-docs files in selected agent skill directories; posts install metadata.
Rationale
This is an explicit user-invoked AI-agent extension installer, not an npm lifecycle attack. Its cross-agent configuration writes warrant a warning under the extension-control policy, but source inspection found no concrete malicious behavior.
Evidence
package.jsondist/cli.jsdist/index.jsdist/skill/architecture-docs/scripts/evidence.mjs~/.claude/skills/architecture-docs~/.cursor/skills/architecture-docs~/.config/github-copilot/skills/architecture-docs~/.agents/skills/architecture-docs~/.codeium/windsurf/skills/architecture-docs.claude/skills/architecture-docs.cursor/skills/architecture-docs.github/skills/architecture-docs.agents/skills/architecture-docs