registry / @meetless/mla / 0.2.7

@meetless/mla@0.2.7

Meetless CLI (mla): governed change-control and knowledge for AI coding agents.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. First-party Meetless integration for Claude Code installs hooks, MCP config, skills, local queues/logs, and optional prompt/context telemetry for activated workspaces. This is a sensitive agent-extension surface but source inspection did not show hidden install-time execution or a malicious chain.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs mla init, mla rewire, mla activate, or installed Claude Code hooks fire in an activated workspace.

Impact

Agent prompts, session metadata, governance events, and derived context may be queued locally and sent to Meetless endpoints after setup/activation.

Mechanism

User-invoked Claude Code hook/MCP/skill setup with local spooling and Meetless API calls

Rationale

The package performs explicit first-party AI-agent integration and telemetry aligned with its stated Meetless CLI purpose, but that control surface is sensitive enough to warn. No unconsented npm install-time mutation, covert credential harvesting, arbitrary remote payload execution, destructive behavior, or broad AI-agent hijack was found.

Evidence

package.jsondist/cli.jsdist/lib/config.jsdist/lib/wire.jsdist/commands/init.jsdist/commands/rewire.jsdist/hooks-template/user-prompt-submit.shdist/hooks-template/common.shdist/connectors/claude-code/plugin-detect.jsdist/lib/spool.js~/.meetless/cli-config.json~/.meetless/hooks/*~/.meetless/queue/*~/.meetless/logs/*~/.claude/settings.json~/.claude.json~/.claude/skills/mla/SKILL.md~/.claude/skills/mla-onboard/SKILL.md~/.claude/agents/*.mdCLAUDE.md.meetless.json

Network endpoints5

control.meetless.aiintel.meetless.aiapp.meetless.aistorage.googleapis.com/meetless-public/cli/releases/latest/VERSIONstorage.googleapis.com/meetless-public/cli/releases/latest/manifest.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/lib/config.js defines Meetless endpoints: control.meetless.ai, intel.meetless.ai, app.meetless.ai.
dist/hooks-template/user-prompt-submit.sh captures prompts in activated workspaces and can call intel /v1/ask.
dist/lib/wire.js writes Claude Code hooks, MCP config, skills, agents, and a CLAUDE.md rules block.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; only user-invoked bin dist/cli.js.
dist/commands/init.js and dist/commands/rewire.js make setup explicit via mla init/rewire, with opt-outs for hooks/MCP/project rules.
Hooks are gated on .meetless.json activation or fail-soft no-op behavior; CE0 hooks emit {} and do not block turns.
Network behavior is package-aligned Meetless telemetry/governance/update traffic, not arbitrary exfiltration.
dist/connectors/claude-code/plugin-detect.js only inspects local claude plugin list and fails safe.
dist/lib/spool.js queue cleanup is age-gated and limited to recognized Meetless queue artifacts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 234 file(s), 2.69 MB of source, external domains: 127.0.0.1, app.meetless.ai, cloud.langfuse.com, control.meetless.ai, github.com, intel.meetless.ai, json-schema.org, meetless.ai, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, storage.googleapis.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

4 flagged

dist/commands/ask.jsView file

Lines 80-120javascript

80 }

81 else if (!sawQuery) {

82 out.query = a;

83 sawQuery = true;

84 }

85 else {

86 throw new Error(`Unexpected positional argument: ${a} (quote the query as a single argument).`);

87 }

88 }

89 if (!out.query.trim()) {

90 throw new Error(`Usage: mla ask "<query>" [--mode answer|search|canonical|compare] [--workspace <id>] [--as-of <date>] [--max <n>] [--min <n>] [--plain]`);

91 }

92 return out;

93}

94// ask-core is plain ESM; `mla` compiles to CommonJS. A literal dynamic import()

95// would be downleveled by tsc to require(), which cannot load an ESM-only

96// package on Node < 22. The Function constructor preserves a TRUE runtime

97// import() so it works on every supported Node (>=18.18). Used only by the dev

98// fallback below (ts-node, no built dist). Resolve ask-core as a sibling package

99// directory (packages/ask-core), three levels up from the compiled commands dir

100// (dist/commands -> dist -> cli -> packages).

101const trueDynamicImport = new Function("u", "return import(u)");

102function askCoreDir() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/ask.jsView on unpkg · L100

103 return path.resolve(__dirname, "..", "..", "..", "ask-core");

104}

105// The CJS bundle the build emits (scripts/bundle-esm.js -> dist/bundles/). It

106// sits a sibling level up from the compiled commands dir: dist/commands -> dist

107// -> dist/bundles.

108function bundlePath(name) {

109 return path.resolve(__dirname, "..", "bundles", name);

110}

111function notesRoot() {

112 if (process.env.MEETLESS_NOTES_ROOT)

113 return process.env.MEETLESS_NOTES_ROOT;

114 // Best-effort: the standalone notes repo is a sibling of the code repo. A

115 // missing INDEX.md degrades to retrieval, so an imperfect guess here is

116 // non-fatal.

117 return path.resolve(__dirname, "..", "..", "..", "..", "..", "notes");

118}

119// Load ask-core from its ESM source files (the original path). Kept as the dev

120// fallback for `pnpm dev` (ts-node), where no dist/bundles exists. Never reached

dist/connectors/claude-code/plugin-detect.jsView file

Lines 38-78javascript

38exports.detectPluginOwnership = detectPluginOwnership;

39// plugin-detect.ts: decide whether THIS machine has our plugin installed, so the

40// migrator (plugin-migrate.ts) and `mla doctor` can reconcile legacy home-dir

41// wiring against it. Ownership is decided by an EXACT match on the fully-qualified

42// id `mla@meetless` (design §6.1), NOT a `startsWith("mla@")` prefix, which would

43// false-own someone else's fork published under a different marketplace. The result

44// is 4-state:

45//

46// owned enabled at user/managed scope: the plugin provides global wiring.

dist/hooks-template/user-prompt-submit.shView file

•path = dist/hooks-template/user-prompt-submit.sh kind = build_helper sizeBytes = 85228 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks-template/user-prompt-submit.shView on unpkg

dist/lib/spool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @meetless/mla@0.2.6 matchedIdentity = npm:QG1lZXRsZXNzL21sYQ:0.2.6 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/spool.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/ask.jsView file

100// (dist/commands -> dist -> cli -> packages). L101: const trueDynamicImport = new Function("u", "return import(u)"); L102: function askCoreDir() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/ask.jsView on unpkg · L100

dist/connectors/claude-code/plugin-detect.jsView file

58// 64KB, GH #36685): the command redirects to a temp file we then read whole. L59: const fs = __importStar(require("fs")); L60: const os = __importStar(require("os"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/connectors/claude-code/plugin-detect.jsView on unpkg · L58

dist/hooks-template/user-prompt-submit.shView file

•path = dist/hooks-template/user-prompt-submit.sh kind = build_helper sizeBytes = 85228 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks-template/user-prompt-submit.shView on unpkg

dist/lib/spool.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/spool.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltadist/lib/spool.js

MediumDynamic Requiredist/connectors/claude-code/plugin-detect.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/hooks-template/user-prompt-submit.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/commands/ask.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/commands/ask.jsView file

Lines 80-120javascript

80 }

81 else if (!sawQuery) {

82 out.query = a;

83 sawQuery = true;

84 }

85 else {

86 throw new Error(`Unexpected positional argument: ${a} (quote the query as a single argument).`);

87 }

88 }

89 if (!out.query.trim()) {

90 throw new Error(`Usage: mla ask "<query>" [--mode answer|search|canonical|compare] [--workspace <id>] [--as-of <date>] [--max <n>] [--min <n>] [--plain]`);

91 }

92 return out;

93}

94// ask-core is plain ESM; `mla` compiles to CommonJS. A literal dynamic import()

95// would be downleveled by tsc to require(), which cannot load an ESM-only

96// package on Node < 22. The Function constructor preserves a TRUE runtime

97// import() so it works on every supported Node (>=18.18). Used only by the dev

98// fallback below (ts-node, no built dist). Resolve ask-core as a sibling package

99// directory (packages/ask-core), three levels up from the compiled commands dir

100// (dist/commands -> dist -> cli -> packages).

101const trueDynamicImport = new Function("u", "return import(u)");

102function askCoreDir() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/ask.jsView on unpkg · L100

103 return path.resolve(__dirname, "..", "..", "..", "ask-core");

104}

105// The CJS bundle the build emits (scripts/bundle-esm.js -> dist/bundles/). It

106// sits a sibling level up from the compiled commands dir: dist/commands -> dist

107// -> dist/bundles.

108function bundlePath(name) {

109 return path.resolve(__dirname, "..", "bundles", name);

110}

111function notesRoot() {

112 if (process.env.MEETLESS_NOTES_ROOT)

113 return process.env.MEETLESS_NOTES_ROOT;

114 // Best-effort: the standalone notes repo is a sibling of the code repo. A

115 // missing INDEX.md degrades to retrieval, so an imperfect guess here is

116 // non-fatal.

117 return path.resolve(__dirname, "..", "..", "..", "..", "..", "notes");

118}

119// Load ask-core from its ESM source files (the original path). Kept as the dev

120// fallback for `pnpm dev` (ts-node), where no dist/bundles exists. Never reached

dist/connectors/claude-code/plugin-detect.jsView file

Lines 38-78javascript

38exports.detectPluginOwnership = detectPluginOwnership;

39// plugin-detect.ts: decide whether THIS machine has our plugin installed, so the

40// migrator (plugin-migrate.ts) and `mla doctor` can reconcile legacy home-dir

41// wiring against it. Ownership is decided by an EXACT match on the fully-qualified

42// id `mla@meetless` (design §6.1), NOT a `startsWith("mla@")` prefix, which would

43// false-own someone else's fork published under a different marketplace. The result

44// is 4-state:

45//

46// owned enabled at user/managed scope: the plugin provides global wiring.

dist/hooks-template/user-prompt-submit.shView file

•path = dist/hooks-template/user-prompt-submit.sh kind = build_helper sizeBytes = 85228 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks-template/user-prompt-submit.shView on unpkg

dist/lib/spool.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/spool.jsView on unpkg