AP006: Agent file would ship in package
| Severity | high, medium or low, by file |
| Runs in | pack, guard hook, git push check |
| One-line fix | Keep it out of the package (.npmignore or the package.json “files” list; your Python build tool’s exclude list) and add it to .gitignore. |
What it finds
Section titled “What it finds”A file written by an AI agent that would be uploaded inside your npm or PyPI package, for example
.claude/settings.local.json or .aider.chat.history.md. The severity depends on the file: each
rule says how sensitive that file usually is.
agentprint pack reads what your package would publish. For a Python project it runs uv build.
For a built archive (.tgz, .tar.gz, .whl, .zip) it reads the file as it is. If the file
holds a key, a separate AP002 print is added.
Why it matters
Section titled “Why it matters”A published package is public and cannot be fully taken back. In April 2026 Lakera reported
that of about 46,500 npm packages it scanned, 428 shipped .claude/settings.local.json.
How to fix
Section titled “How to fix”Keep the file out of the package: use .npmignore or the package.json files list, or your
Python build tool’s exclude list. Also add it to .gitignore. If .npmignore does not exist yet,
copy .gitignore to it first: npm stops reading .gitignore once .npmignore exists.
Limits
Section titled “Limits”- Only files that agent modules know about are matched. Instruction files such as
AGENTS.mdor.clinerules/are never treated as leaks. - A file too large to read, or a link, is reported but its contents are not scanned for keys.
packon a Python project runs your build backend. Use it on projects you trust, or pass an already-built archive.