registry / hscrape / 0.2.9

hscrape@0.2.9

Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm postinstall and CLI use, the package replaces a package-named Claude Code skill directory with bundled instructions. No reviewed JavaScript sends data, executes shell code, or fetches remote content.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or invoking `hscrape`

Impact

Introduces a persistent AI-agent extension and enables scraper/MCP administration when a user elects to use its commands.

Mechanism

first-party Claude skill lifecycle installation plus platform-binary launcher

Rationale

This is a real install-time, first-party agent-extension lifecycle mutation, so it warrants a warning under the stated policy. The reviewed source does not establish concrete malicious behavior or a foreign/broad AI-agent control-surface hijack.

Evidence

package.jsonhscrape.jslib/install-skill.jsskill/SKILL.mdskill/reference/auth-and-scopes.mdskill/reference/mcp-and-tools.mdskill/~/.claude/skills/evo-scraper

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

hscrape@0.2.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code