@xorox-ai/agent@0.0.0
Bootstrap placeholder for Trusted Publishing setup — do not install. Use @xorox-ai/agent@0.1.0 or later.
Connects a coding project to [XOROX](https://xorox.eu) — automatic engineering context for Cursor, plus on-demand access to your project's Specifications and Tasks.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe automatic postinstall mutation creates an agent extension lifecycle risk, but it configures this package's own integration. Under the package policy, this warrants a warning rather than a publish block.
Decision evidence
public snapshot- The package postinstall script automatically runs scripts/postinstall.js during installation.
- The script targets the consumer project's .cursor/hooks.json and .cursor/mcp.json files.
- It adds a before-submit hook and registers the package's own XOROX MCP server in Cursor configuration.
- The hook and MCP server point to this package's own commands, consistent with first-party agent integration setup.
- The before-submit hook requires project-specific credentials before contacting the configured XOROX API.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package postinstall script automatically runs scripts/postinstall.js during installation.
package.jsonView on unpkg · L25Findings
Affected versions and remediation
This report applies to @xorox-ai/agent@0.0.0.
See all versions of @xorox-ai/agent for other recorded verdicts.
- Review the evidence and your use of @xorox-ai/agent@0.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.