Install-time hooks & dependencies1 finding
INFOpackage.json — npm 'prepare' lifecycle hook: install hook runs a build at install (recognized toolchain), standard for a compiled package. Recorded for completeness, not a flag.
Runs code / shell commandsno flags
Whether the server can execute commands on your machine.
Secrets & credentialsno flags
How it reads, logs, or transmits keys and tokens. Scam/wallet-drainer patterns land here.
Network calls outno flags
Hardcoded endpoints it reaches beyond what it documents.
Prompt-injection passthroughno flags
Whether it pipes untrusted external content back as agent instructions.
Permission scope breadthno flags
How much access it asks for versus what its job needs.