Loading npm security reports…
让任意 AI Agent 直接调用 focalapi 创作模型的命令行工具
LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall mutates skills directories for every detected supported AI-agent installation. It installs FocalAPI-owned skill instructions and a manifest without an explicit connect command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource appears to send environment or credential material through DNS lookups.
dist/cli.jsView on unpkg · L41A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkgManifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L26Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L26Source appears to send environment or credential material through DNS lookups.
dist/cli.jsView on unpkg · L41A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkgManifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg