npm AI-agent policy reports, with evidence.

Source proves unconsented npm postinstall mutation of the foreign Hermes agent control surface, meeting the blocking policy. Backups and platform checks limit data loss but do not authori...

Source confirms unconsented postinstall mutation of a foreign, broad AI-agent control surface, meeting the blocking policy. Preserving existing configuration and verifying bundle signatur...

Inspected source establishes automatic mutation of OpenCode's shared control surface, including enabled third-party commands, rather than setup confined to a package-owned extension. This...

Inspected source proves unconsented postinstall mutation of broad and foreign AI-agent control surfaces. This meets the supplied blocking policy independently of scanner similarity labels...

Inspected source establishes unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the explicit blocking policy regardless of the skills' package-relat...

The inspected lifecycle chain performs unconsented, forced writes across foreign AI-agent instruction surfaces. Package-specific skill names do not neutralize this broad automatic mutatio...

Source proves unconsented postinstall mutation of multiple foreign AI-agent control surfaces. Package-branded skill names do not remove the broad installation-time mutation covered by the...

The inspected lifecycle chain automatically invokes broad AI-client configuration without a consent step, meeting the install-time agent control-surface blocking policy. The native implem...

Source proves unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the blocking policy even though the command provides a status display and no exfilt...

Inspected source establishes automatic, unconsented mutation of the consumer’s broad agent control surface, meeting the blocking policy. The verdict rests on the lifecycle caller and over...

Inspected source establishes unconsented postinstall mutation of multiple foreign AI-agent instruction surfaces, meeting the blocking policy. The decision rests on that executable install...

The inspected source establishes automatic install-time MCP setup across foreign AI clients, which meets the supplied blocking policy for unconsented agent control-surface mutation. The v...

Inspected source proves automatic, unconsented install-time mutation of foreign AI-agent control surfaces. This meets the blocking policy regardless of whether the bundled MCP functionali...

Inspected source establishes unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. Hash protections limit overwrites but do not authoriz...

Inspected source establishes unconsented npm postinstall mutation of a broad AI-agent control surface, which meets the blocking policy. The decision rests on the executable installation c...

Inspected source proves unconsented postinstall mutation of a foreign global AI-agent control surface, meeting the explicit blocking policy. Environment guards and permission filters do n...

Source establishes unconsented postinstall mutation of a foreign, global AI-agent control surface. This meets the blocking policy even though explicit CLI setup also offers integration pr...

Source establishes unconsented postinstall mutation of a foreign global agent control surface, meeting the blocking policy. Agent availability and environment checks do not establish cons...

Source establishes unconsented postinstall mutation of a foreign agent's global executable configuration, meeting the explicit blocking policy. Availability checks and package-aligned fun...

Source proves unconsented npm postinstall mutation of a foreign, global AI-agent control surface, meeting the blocking policy. CLI availability checks do not establish prior consent, and...

Source establishes unconsented npm postinstall mutation of a foreign global AI-agent control surface. The installation guards limit activation but do not provide consent for the automatic...