registry / @mulmoclaude/core / 4.8.0

@mulmoclaude/core@4.8.0

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is not malicious by static inspection, but it exposes a guarded mechanism for modifying an AI-agent control surface. Because the mechanism requires an explicit host call and is path- and content-type-restricted, blocking publication is not warranted.

Static reason

One or more suspicious static signals were detected.

Trigger

A consuming host explicitly calls mirrorSkillWrite or mirrorSkillDelete with a workspace root and validated target.

Impact

A host-controlled staged skill can become active Claude skill content in that workspace.

Mechanism

Allowlisted staging-to-Claude skill mirroring.

AI rationale

Evidence

dist/skill-bridge/index.jsdata/skills/<slug>/SKILL.mddata/skills/<slug>/schema.json.claude/skills/<slug>/SKILL.md.claude/skills/<slug>/schema.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The exported skill bridge copies allowlisted staged skill files into a project .claude/skills directory, which Claude can load as agent instructions.
The bridge can recursively delete the corresponding active skill directory when its exported delete function is called.

Evidence against

package.json has no preinstall, install, postinstall, or other lifecycle hook.
The bridge is an exported function with a caller-supplied workspace root; importing it does not perform the write.
The bridge rejects traversal-like paths and only permits SKILL.md, schema.json, or validated template paths.
No self-dependency, dynamic code execution, or network activity is involved in the skill bridge.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Source & flagged code

4 flagged

dist/discovery-2TvulIz8.cjsView file

Lines 1431-1471javascript

1431}

1432/** Return a path DuckDB can read as UTF-8: the original file when it

1433* already is UTF-8 (the cheap, common case — only the head is sniffed),

1434* else a decoded cache copy (see `decodeToCache`). Returns null when

1435* there is no readable file (missing, symlink, or containment-refused —

1436* see `safeCsvStat`), which callers render as an empty collection. */

1437async function ensureUtf8CsvPath(absPath, workspaceRoot) {

1438 const info = await safeCsvStat(absPath, workspaceRoot);

1439 if (info === null) return null;

1440 const head = await readHead(absPath, SNIFF_BYTES);

1441 const sample = head.length === SNIFF_BYTES ? head.subarray(0, 1048573) : head;

1442 if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254

1443 return decodeToCache(absPath, info);

1444}

1445var instancePromise = null;

1446/** Lazily create one shared in-memory DuckDB instance. The dynamic import

1447* keeps the native module OUT of core's load path — a platform where the

1448* prebuilt binding is missing degrades to a per-query error on dataSource

1449* collections only, never a broken core. A failed init is retried on the

1450* next call (the promise is reset). */

1451async function duckDbInstance() {

1452 if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));

1453 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-2TvulIz8.cjsView on unpkg · L1451

1454 return await instancePromise;

1455 } catch (err) {

1456 instancePromise = null;

1457 throw new BackendUnavailableError(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);

1458 }

1459}

1460async function queryCsv(sql, params) {

1461 const connection = await (await duckDbInstance()).connect();

1462 try {

1463 return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();

1464 } finally {

1465 connection.disconnectSync();

1466 }

1467}

1468async function csvList(absPath, primaryKey, workspaceRoot) {

1469 const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());

1470 if (utf8Path === null) return {

1471 items: [],

dist/skill-bridge/index.jsView file

Lines 1-40javascript

1import { t as isSafeActionTemplatePath } from "../templatePath-k_WNbL_Q.js";

2import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";

3import path from "node:path";

4//#region src/skill-bridge/index.ts

5var

dist/promptSafety-Cv-SoTd4.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/promptSafety-Cv-SoTd4.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

dist/discovery-2TvulIz8.cjsView file

1451package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api L1451: async function duckDbInstance() { L1452: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:")); L1453: try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-2TvulIz8.cjsView on unpkg · L1451

dist/skill-bridge/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js"; import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs"; import path from "node:path"; var data_skills_dir = path.join("data", "skills"); var claude_skills_dir = path.join(".claude", "skills"); var sk[redacted] = "skill.md"; var schema_filename = "schema.json"; var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/; var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/; var recursive_flag_re = /[rr]/; function dataskilldir(workspaceroot, slug) {

Findings

3 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/discovery-2TvulIz8.cjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js

HighSemantic Analysis Limiteddist/promptSafety-Cv-SoTd4.cjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/skill-bridge/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mulmoclaude/core@4.8.0.

See all versions of @mulmoclaude/core for other recorded verdicts.

Review the evidence and your use of @mulmoclaude/core@4.8.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 12:44:44.713Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code