registry / hscrape / 0.2.8

hscrape@0.2.8

0.2.8 is missing its Windows binary — use hscrape@>=0.2.9

Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time code modifies the user's Claude Code skills directory. It removes the existing `evo-scraper` skill directory before copying the package-bundled replacement.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

`npm install` runs `postinstall`; invoking `hscrape` also calls `ensure()`.

Impact

Unconsented agent-extension installation and overwrite of the package-owned skill directory.

Mechanism

Lifecycle-installed Claude Code skill replacement.

Rationale

The package has a concrete, unconsented postinstall mutation of a Claude Code skill directory, warranting a warning under the lifecycle policy. Source inspection did not establish a malicious chain beyond that extension setup.

Evidence

package.jsonhscrape.jslib/install-skill.jsskill/SKILL.mdskill/~/.claude/skills/evo-scraper~/.claude/skills/evo-scraper/.hscrape-version

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

hscrape@0.2.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code