@mulmoclaude/core@0.7.0
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./whisper/client, ./workspace-setup/slug, ./translatio
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains an explicit, scoped Claude-skill installation feature backed by remote registry content. It is not malicious, but warrants a warning under the agent-extension lifecycle policy.
Decision evidence
public snapshot- `dist/collection/registry/server/index.js` downloads registry bundles and mirrors allowlisted files into `.claude/skills/<slug>/`.
- This agent-extension write occurs after explicit `importRegistry`/collection import, not at npm install.
- `dist/skill-bridge/index.js` also mirrors allowlisted `data/skills/<slug>` writes and recursive deletes to active Claude skill paths.
- `package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
- Skill paths use slug and allowlist checks; no broad Claude/Codex/Cursor config write was found.
- No credential harvesting, exfiltration, eval/vm, or remote code loader was found.
- Whisper downloads fixed Hugging Face model URLs and uses loopback-only inference.
Source & flagged code
2 flagged · loading source`dist/collection/registry/server/index.js` downloads registry bundles and mirrors allowlisted files into `.claude/skills/<slug>/`.
dist/collection/registry/server/index.jsView on unpkg`dist/skill-bridge/index.js` also mirrors allowlisted `data/skills/<slug>` writes and recursive deletes to active Claude skill paths.
dist/skill-bridge/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to @mulmoclaude/core@0.7.0.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.