Loading npm security reports…
26 OpenCode agent profiles (22 subagents + 4 primary) + 6 skills (caveman, skill-creator, teach-me, README & SVG hero generators, humanizer-pro) — SWE roles, web research, and architecture agents
LPM treats this as warn-only first-party agent extension lifecycle risk. Postinstall deploys this package's agent profiles and skills into OpenCode configuration directories. This is a first-party agent-extension lifecycle mutation, not a confirmed malicious chain.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/swe-pro-agents.jsView on unpkg · L13Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install.jsView on unpkg · L5Package ships non-JavaScript build or shell helper files.
skills/svg-hero-generator/scripts/repo_signals.pyView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L41Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L41Package ships non-JavaScript build or shell helper files.
skills/svg-hero-generator/scripts/repo_signals.pyView on unpkgPackage source references dynamic require/import behavior.
bin/swe-pro-agents.jsView on unpkg · L13Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/install.jsView on unpkg · L5