Loading npm security reports…
让任意 AI Agent 直接调用 focalapi 创作模型的命令行工具
LPM treats this as warn-only first-party agent extension lifecycle risk. On npm install, the package automatically detects local AI-agent installations and adds its bundled skills to their shared or vendor-specific skills directories. This changes agent behavior without an explicit setup command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource appears to send environment or credential material through DNS lookups.
dist/cli.jsView on unpkg · L70A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkgManifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L26Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L26Source appears to send environment or credential material through DNS lookups.
dist/cli.jsView on unpkg · L70A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkgManifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg