registry / @66rpg/lumimaker / 0.1.35
@66rpg/lumimaker@0.1.35
幻光 lumimaker 平台工具：validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a user-run CLI wrapper for the 66rpg lumimaker tools. The AGENTS.md hit is a required template file check, and skill installation, dependency updates, and analytics are explicit CLI actions rather than install hooks.
Static reason
One or more suspicious static signals were detected.
Trigger
No install-time or import-time trigger runs the package. Behavior starts when a user runs the lumimaker command.
Impact
No unconsented agent-config mutation, credential theft, or remote payload execution was found in this package.
Mechanism
The wrapper checks that a game template contains AGENTS.md, prompts before the skill command, and spawns the vendor binary. Analytics stays on the vendor sensors host.
AI rationale
This is a user-run CLI wrapper for the 66rpg lumimaker tools. The AGENTS.md hit is a required template file check, and skill installation, dependency updates, and analytics are explicit CLI actions rather than install hooks.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json only publishes a lumimaker bin and build, test, pack, and prepublish scripts, with no preinstall, install, or postinstall hook.
- In dist/index.js, AGENTS.md is one required file in template validation beside package.json and README.md, not a write to an agent control file.
- The skill subcommand asks for a platform unless the user already passed --platform or --all, then forwards that choice to the vendor binary.
Evidence against
- skill-targets.json names several editor skill directories, and the skill command can forward --all when the user asks.
- On an explicit confirm or --apply-update, the CLI may npm-install newer @66rpg lumimaker packages as dev dependencies in a project that already has package.json.
- CLI use can POST product analytics to the allowlisted 66rpg sensors host unless disabled by environment settings.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggeddist/index.jsView file
1import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
1import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import B from"picocolors";import{spawn as jo}from"node:child_process";import A from"node:fs";import Eo from"node:os";import F from"node:path";var Dt={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var Xo=new Set(["publish","publish-template","publish-template-data","publish-project"]);function Ge(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.35.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.