process-ai@0.14.0
Framework method-agnóstico de mapeamento de processos ponta-a-ponta — equipe de 9 agentes IA (Déa+Bento+Miguel+Júlia+Guilherme+Zanoni+Laura+Tiago+Monique) que conduz o usuário por Q&A até documentar o processo completo (ingestão documental→SIPOC→hierarqui
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not shown to be malicious, but its automatic postinstall modifies a Claude Code control surface and installs Python dependencies. This fits a guarded first-party agent extension lifecycle risk that should be warned on rather than blocked.
Decision evidence
public snapshot- The npm postinstall hook launches the package installer in the consumer project.
- The installer automatically copies process-ai Claude Code skills and runs pip to install ingestion dependencies.
- The CLI makes a non-blocking npm registry version check and writes a local cache.
- No runtime dependency on process-ai itself is declared.
- The inspected code scopes skill writes to the target project's .claude directory and rejects symlink escapes.
- No credential harvesting, secret exfiltration, remote code loading, or reviewer-directed text was found in inspected source.
Source & flagged code
9 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
scripts/docs-site/vendor/d3/7/d3.min.jsFindings
Affected versions and remediation
This report applies to process-ai@0.14.0.
See all versions of process-ai for other recorded verdicts.
- Review the evidence and your use of process-ai@0.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.