Loading npm security reports…
Roleflow: sistema OpenCode portable con roles por responsabilidad + routing barato + ahorro de tokens. Público, instalable desde cualquier PC o server con una línea en opencode.json.
LPM treats this as warn-only first-party agent extension lifecycle risk. Automatic setup copies package-owned OpenCode agents and skills into the user's OpenCode configuration directory. This is a guarded first-party extension setup risk; no confirmed malicious attack was identified.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe package runs a postinstall script that copies its agents and skills into the OpenCode configuration directory.
package.jsonView on unpkg · L27The package runs a postinstall script that copies its agents and skills into the OpenCode configuration directory.
postinstall.mjsView on unpkg · L9The plugin repeats that copy into the same directory when it starts, creating an automatic OpenCode extension setup path.
dist/index.jsView on unpkg · L75This report applies to roleflow@1.0.7.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L30Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L30The package runs a postinstall script that copies its agents and skills into the OpenCode configuration directory.
package.jsonView on unpkg · L27The package runs a postinstall script that copies its agents and skills into the OpenCode configuration directory.
postinstall.mjsView on unpkg · L9The plugin repeats that copy into the same directory when it starts, creating an automatic OpenCode extension setup path.
dist/index.jsView on unpkg · L75