@66rpg/lumimaker@0.1.44
幻光文游制作器：登录、校验并发布到幻光文游社区；validate-template（TS）；login / publish 等转发 lumimaker
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains an explicit AI-agent configuration capability but no install-time trigger or concrete malicious behavior. A warning is appropriate for the guarded agent-control surface.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the skill command.
Impact
This can modify agent-facing project configuration when explicitly requested; no unconsented execution path was established.
Mechanism
The CLI routes the skill command to its handler and the package declares supported agent skill-directory targets.
AI rationale
The package contains an explicit AI-agent configuration capability but no install-time trigger or concrete malicious behavior. A warning is appropriate for the guarded agent-control surface.
Evidence
dist/index.jsskill-targets.json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest defines build and packaging scripts but no install lifecycle hook.
- The bundle dispatches an explicit skill command to its CLI handler.
- The package lists project skill directories for several AI coding tools, including Codex and Claude.
- Analytics excludes credential, cookie, authorization, password, and token fields from event properties.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
1import G from"picocolors";import{spawn as Oo}from"node:child_process";import A from"node:fs";import $o from"node:os";import V from"node:path";var $t={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var cr=new Set(["publish","publish-template","publish-template-data","publish-project"]);function We(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
1import G from"picocolors";import{spawn as Oo}from"node:child_process";import A from"node:fs";import $o from"node:os";import V from"node:path";var $t={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var cr=new Set(["publish","publish-template","publish-template-data","publish-project"]);function We(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11import G from"picocolors";import{spawn as Oo}from"node:child_process";import A from"node:fs";import $o from"node:os";import V from"node:path";var $t={$schema:"http://json-schema.or...
L2: `),!0}catch{return!1}}var cr=new Set(["publish","publish-template","publish-template-data","publish-project"]);function We(e,t){let n=e[t];return typeof n!="string"?void 0:n.trim()...
Findings
5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/validate.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @66rpg/lumimaker@0.1.44.
See all versions of @66rpg/lumimaker for other recorded verdicts.
- Review the evidence and your use of @66rpg/lumimaker@0.1.44 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.