registry / @lizard-build/lizard-studio-host / 1.0.22

@lizard-build/lizard-studio-host@1.0.22

Native-messaging host installer that lets the Lizard Studio browser extension drive the local Claude Code CLI.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicitly invoked installer registers a Lizard browser native host, which can spawn Claude and expose browser-control tools. At runtime it can refresh a bundled skill and update its host code from vendor endpoints.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs lizard-studio-host/install-host, then the allowed Lizard extension starts the native host or sends selfUpdate.

Impact

A compromised vendor publishing channel or allowed extension can influence/update the local AI-agent integration; no unconsented install-time execution is present.

Mechanism

First-party native host with remote skill/code refresh and Claude browser-MCP bridge.

AI rationale

The scanner's download/execute finding is real, but it is runtime behavior in an explicitly installed first-party host, not an npm lifecycle payload. The mutable skill refresh and remote self-update justify a warning under the agent-extension lifecycle policy.

Evidence

package.jsonsrc/host/install.mjssrc/host/claude-host.mjssrc/host/mcp-browser.mjs~/.lizard-studio/host

Network endpoints2

raw.githubusercontent.com/lizard-build/skill/mainregistry.npmjs.org/@lizard-build/lizard-studio-host/latest

@lizard-build/lizard-studio-host@1.0.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code