registry / @mulmoclaude/core / 4.4.1
@mulmoclaude/core@4.4.1
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe scanner’s integration hints describe project skill mirroring, but the source constrains the affected paths and slug and the package has no install hook. The inspected source supports a clean verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller invokes the skill bridge or registry operations during normal package use.
Impact
No confirmed attack or unconsented install-time agent control-surface mutation was established.
Mechanism
The bridge mirrors allowlisted skill files into a project Claude skills directory and removes only a validated skill slug; no npm install lifecycle hook was found.
AI rationale
The scanner’s integration hints describe project skill mirroring, but the source constrains the affected paths and slug and the package has no install hook. The inspected source supports a clean verdict.
Evidence
data/skills/<slug>.claude/skills/<slug>
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines build, typecheck, test, and lint scripts; it has no preinstall or postinstall hook.
- The skill bridge limits mirrored files to validated skill paths and names, with recursive removal restricted to a single validated slug.
- Registry server comments describe mirroring skills between data/skills and .claude/skills; the server bundle describes reading user or feed skills from their discovered directories.
- Discovery and prompt-safety bundles begin with ordinary local module imports.
- Google broker URL override is used with a package-defined default broker URL.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flagged · loading sourcedist/discovery-Dl9nRa-m.cjsView file
1439package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api
L1439: async function duckDbInstance() {
L1440: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));
L1441: try {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/discovery-Dl9nRa-m.cjsView on unpkg · L1439dist/skill-bridge/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js";
import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs";
import path from "node:path";
var data_skills_dir = path.join("data", "skills");
var claude_skills_dir = path.join(".claude", "skills");
var sk[redacted] = "skill.md";
var schema_filename = "schema.json";
var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/;
var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/;
var recursive_flag_re = /[rr]/;
function dataskilldir(workspaceroot, slug) {
Findings
4 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/discovery-Dl9nRa-m.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js
HighSemantic Analysis Limiteddist/promptSafety-C0BWDsfT.cjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/google/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@4.4.1.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@4.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.