registry / @luckydraw/cumulus / 1.0.51

@luckydraw/cumulus@1.0.51

RLM-based CLI chat wrapper for Claude with external history context management

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The source shows a first-party agent email capability that is gated by the user’s Resend configuration but lacks per-send approval. That residual capability warrants a warning; the inspected source does not support a malicious or install-time verdict.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the gateway, configures a Resend API key, and an agent invokes the email tool.

Impact

An agent can send email under the configured account without per-message human approval. No credential theft or malicious use was established.

Mechanism

The gateway passes a local MCP server and the configured key to agent turns; the tool submits its supplied recipient, subject, and body to Resend.

AI rationale

Evidence

dist/gateway/daemon.jsdist/lib/gateway.jsdist/gateway/gateway-agents-mcp.js

Network endpoints1

api.resend.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The gateway supplies a first-party MCP server to agent turns. It passes Resend credentials only when the gateway configuration contains them, and the email tool is exposed only when a Resend key is present.
The email tool accepts a recipient, subject, and body, then sends them to api.resend.com. The code checks for a configured key and rate-limits sends, but the tool path has no per-send human approval.
The flagged account callers resolve to MCP configuration or messages delivered to named agent threads through configured, scheduled, or adapter workflows; they do not show an automatic third-party account change.
The manifest’s prepare hook runs Husky and prepublishOnly runs a build and type check. Gateway service setup is an explicit command, and service installation requires an affirmative interactive choice.
Other inspected runtime matches resolve to local parsing, CLI/config generation, git/task handling, thread workflows, or a loopback preview proxy; no separate attack behavior was established.

Evidence against

Behavioral surface

Source

ChildProcess

Source & flagged code

8 flagged

dist/tui/hooks/useClaudeProcess.jsView file

Lines 1-23javascript

1/**

2 * Hook for managing Claude subprocess and streaming.

3 */

4import { spawn } from 'child_process';

5import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

6import { ContextBudget } from '../../lib/context-budget.js';

7import { StreamProcessor } from '../../lib/stream-processor.js';

8import { extractTextFromStreamLine } from '../utils/streamParser.js';

9export function useClaudeProcess(options) {

10 const { mcpConfigPath, contentStore, onText, onComplete, onError, onExternalize, onTTFT } = options;

11 const processRef = useRef(null);

12 const responseRef = useRef('');

13 const bufferRef = useRef('');

14 const completedRef = useRef(false);

15 const spawnTimeRef = useRef(0);

16 const ttftFiredRef = useRef(false);

17 const kill = useCallback(() => {

18 const partial = responseRef.current;

19 if (processRef.current) {

20 processRef.current.kill('SIGTERM');

21 processRef.current = null;

22 }

23 return partial;

dist/lib/gateway.jsView file

Lines 2314-2354javascript

2314 // under --permission-mode bypassPermissions it is a guaranteed no-op — so deny-by-default

2315 // has to be expressed as a denylist. Gated on the field being present so an unconstrained

2316 // thread never pays for the inventory probe (a subprocess spawn) at all.

2317 const effectiveDisallowedTools = mergedConfig.allowedTools

2318 ? compileDisallowedTools(mergedConfig.allowedTools, await

dist/gateway/server.jsView file

Lines 1-31javascript

1/**

2 * Gateway HTTP server — exposes the cumulus message pipeline as a REST API

3 * with SSE streaming. Channel adapters and remote clients connect here.

4 *

5 * Endpoints:

6 * POST /api/thread/:name/message — submit message, SSE stream response

7 * POST /api/thread/:name/sync — sync messages from local mode (store only, no Claude)

8 * GET /api/thread/:name/history — recent messages

9 * GET /api/thread/:name/status — thread info + adaptive state

10 * GET /api/threads — list all threads

dist/gateway/setup.jsView file

Lines 1-27javascript

1/**

2 * cumulus-gateway setup wizard and config management.

3 *

4 * Phase 1: `cumulus-gateway setup --project-root <path>` — instant non-interactive setup

5 * Phase 2: `cumulus-gateway setup` — interactive prompts with auto-detection

6 * Phase 4: `cumulus-gateway config set/get/list` — post-install config changes

7 */

8import { execSync } from 'child_process';

9import

dist/lib/version-check.jsView file

Lines 159-199javascript

159export function saveUpdateState(from, to) {

160 const state = {

161 previousVersion: from,

162 updatedAt: new Date().toISOString

dist/gateway/daemon.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/gateway/daemon.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @luckydraw/cumulus@1.0.4 matchedIdentity = npm:QGx1Y2t5ZHJhdy9jdW11bHVz:1.0.4 similarity = 0.564 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/gateway.jsView on unpkg

2334// Windows: spawn() can't directly exec .cmd/.bat shims (CVE-2024-27980). L2335: // Routing through cmd.exe is required for the npm-installed `claude.cmd`. L2336: const isWindowsShim = process.platform === 'win32' && /\.(cmd|bat|ps1)$/i.test(resolvedClaudePath);

Findings

1 Critical5 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/lib/gateway.js

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

HighSemantic Analysis Limiteddist/gateway/daemon.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/gateway/server.js

Affected versions and remediation

This report applies to @luckydraw/cumulus@1.0.51.

See all versions of @luckydraw/cumulus for other recorded verdicts.

Review the evidence and your use of @luckydraw/cumulus@1.0.51 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 10:46:47.069Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.