registry / @mulmoclaude/core / 0.8.0
@mulmoclaude/core@0.8.0
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./whisper/client, ./workspace-setup/slug, ./translatio
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource shows an intentional, guarded first-party Claude skill installation capability invoked through exported runtime APIs. No concrete malicious behavior, unconsented lifecycle mutation, credential theft, or payload execution was found.
Static reason
No blocking static signals were detected.
Trigger
Host calls exported `importRegistry`/`performImport` or other skill-sync APIs.
Impact
Imported skill instructions and safe templates become discoverable by Claude in that workspace.
Mechanism
Remote collection fetch and allowlisted `.claude/skills` mirroring.
AI rationale
Source shows an intentional, guarded first-party Claude skill installation capability invoked through exported runtime APIs. No concrete malicious behavior, unconsented lifecycle mutation, credential theft, or payload execution was found.
Evidence
package.jsondist/collection/registry/server/index.jsdist/skill-bridge/index.jsdist/workspace-setup/index.jsdist/feeds/server/index.jsdist/whisper/index.jsdata/skills/<slug>.claude/skills/<slug>
Network endpoints2
receptron.github.io/mulmoclaude-collections/index.jsonraw.githubusercontent.com/receptron/mulmoclaude-collections/main
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit import fetches collection bundles and mirrors allowlisted files into `.claude/skills/<slug>`.
- `performImport` is exported for host runtime use; no npm lifecycle hook invokes it.
- Remote registry defaults are HTTPS and configurable through two environment variables.
- Skill bridge restricts slugs and mirrored paths to `SKILL.md`, `schema.json`, and safe templates.
Evidence against
- package.json has no preinstall, install, or postinstall script.
- No credential harvesting, secret-file reads, or exfiltration path found.
- No eval/vm/Function or shell-command execution found; Whisper uses fixed executable arguments.
- Feed HTTP client blocks private and loopback destinations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
7 Medium4 Low
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
MediumAi Review Evidence
MediumSuspicious Lifecycle Evidence
MediumAi Review Evidence
MediumAi Review Evidence
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@0.8.0.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.