registry / @mulmoclaude/core / 0.5.0
@mulmoclaude/core@0.5.0
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./whisper/client, ./workspace-setup/slug and ./transla
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis package has no install hooks or covert execution chain, but it deliberately installs remote, active Claude skills into a project workspace when its import API is invoked. Policy classifies first-party package-owned agent extension setup as warn.
Static reason
No blocking static signals were detected.
Trigger
Host calls `importRegistry` / `performImport` for a selected collection.
Impact
Remote registry content can become an active project-scoped Claude skill.
Mechanism
Remote skill-bundle import and `.claude/skills` mirroring.
AI rationale
This package has no install hooks or covert execution chain, but it deliberately installs remote, active Claude skills into a project workspace when its import API is invoked. Policy classifies first-party package-owned agent extension setup as warn.
Evidence
package.jsondist/collection/registry/server/index.jsdist/skill-bridge/index.js<workspaceRoot>/data/skills/<slug>/<workspaceRoot>/.claude/skills/<slug>/
Network endpoints2
receptron.github.io/mulmoclaude-collections/index.jsonraw.githubusercontent.com/receptron/mulmoclaude-collections/main
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Registry import fetches remote collection bundles and mirrors allowlisted files into `.claude/skills`.
- Imported `SKILL.md` is active Claude-discovered content.
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- Import is an exported POST-facing operation, not package install-time execution.
- Bridge limits slugs and mirrored paths to SKILL.md, schema.json, and safe templates.
- No credential harvesting, exfiltration, eval, or shell execution found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
WildcardDependency
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
5 Medium4 Low
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
MediumAi Review Evidence
MediumAi Review Evidence
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@0.5.0.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.