sppurt
커머스 운영 자동화 CLI — Cafe24, Coupang, SmartStore, Shopify 통합 관리
This report shows the evidence for sppurt@0.6.0. 0 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook automatically runs `setup-skills`, which registers Claude Code skills under `~/.claude/skills/`. This is automatic setup of the package’s own agent extension, a warning-level lifecycle risk.
Decision evidence
public snapshot- The postinstall hook launches the packaged CLI with the `setup-skills` command.
- The CLI help says `setup-skills` registers Claude Code skills under `~/.claude/skills/`.
- The manifest describes the package as an e-commerce operations CLI.
- The install hook invokes the package’s own skill setup command; the reviewed install path does not show unrelated data transmission.
Source & flagged code
10 flaggedInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage source references child process execution.
Findings
Affected versions and remediation
This report applies to sppurt@0.6.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of sppurt@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.