npm AI-agent policy reports, with evidence.

The inspected chain automatically modifies foreign AI-agent control surfaces during postinstall and removes an inherited safety preload. Those concrete behaviors exceed guarded package-ow...

Inspected source establishes automatic mutation of foreign AI-agent control surfaces and removal of a safety preload during installation. This meets the blocking policy despite the packag...

Inspected source proves unconsented postinstall mutation of foreign AI-agent control surfaces, including overwriting and pruning existing skills. This supports blocking under the agent co...

Inspected source establishes unconsented postinstall mutation of a foreign AI-agent control surface. This meets the blocking policy independently of scanner labels or citation coverage li...

Inspected source proves unconsented postinstall mutation of global Claude Code command hooks, meeting the blocking policy for AI-agent control surfaces. Same-vendor binary names and condi...

Inspected source proves unconsented postinstall mutation of broad, foreign AI-agent control surfaces, including instruction files and tool approval configuration. This meets the blocking...

Source establishes automatic, unconsented replacement and deletion across a shared agent configuration directory. This meets the blocking policy for broad install-time agent control-surfa...

Inspected source establishes unconsented postinstall mutation of foreign, global AI-agent control surfaces, meeting the blocking policy. The decision rests on executable lifecycle and con...

The inspected source proves unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the blocking policy regardless of whether the local MCP tools otherwi...

Inspected source establishes unconsented postinstall mutation of a broad, foreign AI-agent control surface, meeting the explicit blocking policy. Package-aligned tools and an opt-out do n...

Inspected executable source establishes unconsented postinstall mutation of foreign user-level AI-agent control surfaces, which meets the explicit blocking policy. This conclusion does no...

Inspected source proves unconsented postinstall mutation of foreign, user-wide AI-agent control surfaces. This meets the blocking policy regardless of source-similarity scanner labels.

Inspected source establishes unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the supplied blocking policy. The decision rests on the executable installation...

Direct source inspection establishes unconsented postinstall mutation of broad third-party AI-agent control surfaces, meeting the blocking policy. Source citation tools failed with a clos...

Inspected source establishes unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Citation issuance repeatedly failed because the tool trans...

Inspected source establishes unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Citation issuance repeatedly failed because the tool trans...

Inspected source proves unconsented postinstall mutation of foreign and broad AI-agent control surfaces, which meets the blocking policy. The verdict rests on the executable installation...

Source confirms automatic postinstall mutation of OpenClaw's skill directory without consent. This meets the blocking policy for foreign AI-agent control-surface writes, despite otherwise...

The source establishes automatic, unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. The limited skill scope and absence of exfiltrat...

The inspected lifecycle chain performs unconsented changes to foreign AI-agent control surfaces and explicitly disables a safety preload. These concrete behaviors exceed guarded package-o...

Source establishes automatic, unconsented install-time mutation of foreign AI-agent control surfaces, accompanied by targeted safety-preload removal. This meets the blocking policy despit...