workflow-agent-cli@2.23.6

One or more suspicious static signals were detected.

npm installation of a non-global dependency from node_modules

A dependency silently establishes persistent workflow instructions that can influence AI agents and developer actions.

automatic project and AI-agent instruction-surface mutation

On installation, the package derives the consuming project root, modifies its package scripts, installs mandatory guideline files, and generates .github/copilot-instructions.md. That instruction file summarizes package-provided rules for AI agents; the bundled rules direct repository-changing Git operations. These changes occur without an explicit setup command, making the install hook an unconsented mutation of a broad AI-agent control surface.

The package performs unconsented postinstall writes to the consumer project and GitHub Copilot instruction surface. Although no install-time exfiltration was found, this meets the blocking policy for broad AI-agent control-surface mutation.