workflow-agent-cli@2.23.7

One or more suspicious static signals were detected.

npm postinstall during local dependency installation

Future AI-agent sessions can be directed to stage, commit, and push project changes.

silent project mutation and Copilot instruction injection

On installation, the lifecycle script locates the consumer project, alters its package scripts, installs mandatory workflow templates, and writes .github/copilot-instructions.md. That file is designated as the AI agents' source of truth and summarizes the installed guidelines. One mandatory guideline directs agents to automatically set up missing tools and to stage, commit, and push changes to the repository origin. This is an unconsented install-time mutation of a broad, foreign AI-agent control surface.

The package has concrete install-time project and AI-agent control-surface writes, not merely dormant CLI functionality. This meets the block boundary for unconsented postinstall mutation of a broad agent control surface.