registry / @mulmoclaude/core / 0.25.0
@mulmoclaude/core@0.25.0
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./whisper/client, ./workspace-setup/slug, ./translatio
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious: no install hooks or automatic execution were found. Warn because explicit remote content is activated in a Claude skill control surface.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Host/user invokes importRegistry or performImport for a collection.
Impact
Imported remote instructions can influence Claude behavior in that workspace.
Mechanism
Remote skill-bundle import and controlled .claude skill mirroring
AI rationale
Not malicious: no install hooks or automatic execution were found. Warn because explicit remote content is activated in a Claude skill control surface.
Evidence
package.jsondist/collection/registry/server/index.jsdist/skill-bridge/index.jsdist/google/index.jsdata/skills/<slug>data/skills/<slug>/SKILL.mddata/skills/<slug>/schema.json.claude/skills/<slug>
Network endpoints2
receptron.github.io/mulmoclaude-collections/index.jsonraw.githubusercontent.com/receptron/mulmoclaude-collections/main
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/collection/registry/server/index.js imports remote bundles into .claude/skills.
- dist/skill-bridge/index.js mirrors SKILL.md and templates to active Claude skill paths.
- Registry defaults fetch from receptron.github.io and raw.githubusercontent.com.
- dist/google/index.js handles OAuth tokens and Google Calendar/Tasks/Drive APIs.
Evidence against
- package.json has no preinstall, install, or postinstall hooks.
- Skill import is an exported performImport/importRegistry operation, not import-time behavior.
- Skill mirror restricts paths to an allowlist and safe slugs.
- Google token files are written with mode 0600; broker requires HTTPS.
- No covert exfiltration, eval, or shell-command execution found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
1 flagged · loading sourcedist/google/index.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @mulmoclaude/core@0.23.0
matchedIdentity = npm:QG11bG1vY2xhdWRlL2NvcmU:0.23.0
similarity = 0.646
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/google/index.cjsView on unpkgFindings
1 High3 Medium4 Low
HighPrevious Version Dangerous Deltadist/google/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@0.25.0.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@0.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.