registry / @mulmoclaude/core / 3.7.0
@mulmoclaude/core@3.7.0
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious chain was found, but the exported Claude skill activation/removal capability is an AI-agent extension lifecycle risk and warrants a warning under the supplied policy.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A host explicitly calls mirrorSkillWrite or mirrorSkillDelete after staging a skill.
Impact
A caller can add or remove a Claude-discoverable skill within its workspace.
Mechanism
Validated staging-to-Claude-skill directory mirroring.
AI rationale
No concrete malicious chain was found, but the exported Claude skill activation/removal capability is an AI-agent extension lifecycle risk and warrants a warning under the supplied policy.
Evidence
package.jsondist/skill-bridge/index.jsdist/whisper/index.js<workspaceRoot>/data/skills/<slug>/**<workspaceRoot>/.claude/skills/<slug>/**
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/skill-bridge/index.js mirrors staged files into .claude/skills.
- The bridge permits SKILL.md, schema.json, and safe action-template paths.
- Mirror/delete functions write or recursively remove active Claude skill directories.
- package.json has no npm lifecycle scripts or bin entrypoint.
Evidence against
- Bridge actions require an importing host to call exported functions; no import-time invocation is present.
- Skill slug and relative paths are validated; writes remain under workspace .claude/skills/<slug>.
- Whisper subprocess/network behavior is explicit runtime transcription support, with a fixed Hugging Face model URL and localhost sidecar.
- No credential harvesting, arbitrary shell execution, eval, or covert exfiltration was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
3 flagged · loading sourcedist/store-_61sO8K8.jsView file
2596package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api
L2596: async function duckDbInstance() {
L2597: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));
L2598: try {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/store-_61sO8K8.jsView on unpkg · L2596dist/skill-bridge/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js";
import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs";
import path from "node:path";
var data_skills_dir = path.join("data", "skills");
var claude_skills_dir = path.join(".claude", "skills");
var sk[redacted] = "skill.md";
var schema_filename = "schema.json";
var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/;
var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/;
var recursive_flag_re = /[rr]/;
/** `<workspaceroot>/data/skills/<slug>` — the staging dir for a skill. */
function dataskilldir(workspaceroot, slug) {
Findings
3 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/store-_61sO8K8.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js
HighPrevious Version Dangerous Deltadist/whisper/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@3.7.0.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@3.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.