registry / @lizard-build/lizard-studio-host / 1.0.21

@lizard-build/lizard-studio-host@1.0.21

Native-messaging host installer that lets the Lizard Studio browser extension drive the local Claude Code CLI.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicitly installed browser native host can start Claude sessions and provide browser-control MCP tools. On host startup it fetches a mutable vendor skill and exposes it to each spawned Claude session.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the install command, then the allowed Lizard browser extension starts the native host.

Impact

A compromised upstream skill could influence Claude-agent actions in the user-selected project and browser session.

Mechanism

Origin-locked native host with remote skill refresh and local Claude/MCP bridge.

AI rationale

No covert install-time behavior, credential exfiltration, or foreign broad agent-control mutation was found. The mutable remote skill automatically injected into an agent session is a concrete supply-chain/control-surface risk, but not evidence of malicious intent in this package.

Evidence

package.jsonsrc/host/install.mjssrc/host/claude-host.mjssrc/host/mcp-browser.mjs~/.lizard-studio/host

Network endpoints2

raw.githubusercontent.com/lizard-build/skill/mainregistry.npmjs.org/@lizard-build/lizard-studio-host/latest

@lizard-build/lizard-studio-host@1.0.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code