registry / @mulmoclaude/core / 4.9.3

@mulmoclaude/core@4.9.3

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No malicious install-time execution or stealthy exfiltration was found. The package nevertheless provides a guarded first-party Claude skill installation mechanism, which warrants a warning under the extension lifecycle policy.

Static reason

One or more suspicious static signals were detected.

Trigger

A host application invokes collection import or schema write operations.

Impact

Imported or edited skill content can affect Claude behavior in that project.

Mechanism

Mirrors allowlisted staged skill files into .claude/skills.

AI rationale

Evidence

dist/skill-bridge/index.jsdist/collection/registry/server/index.jsdist/server-Dk9x1VLG.jsdata/skills/<slug>/SKILL.mddata/skills/<slug>/schema.json.claude/skills/<slug>/SKILL.md.claude/skills/<slug>/schema.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Its collection operations mirror staged content into the active .claude/skills directory.
Its Google OAuth flow sends authorization data and refresh tokens to a Mulmo cloud-function broker.

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
The skill bridge restricts paths to allowlisted files and validates the skill slug.
The broker requires HTTPS except for loopback and validates the Google consent host.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 1.86 MB of source, external domains: 127.0.0.1, asia-northeast1-mulmoserver.cloudfunctions.net, cdn.jsdelivr.net, cdn.plot.ly, cdnjs.cloudflare.com, fonts.googleapis.com, fonts.gstatic.com, github.com, huggingface.co, oauth2.googleapis.com, raw.githubusercontent.com, receptron.github.io, tasks.googleapis.com, unpkg.com, www.googleapis.com, www.w3.org

Source & flagged code

4 flagged

dist/discovery-BkIKvdh0.jsView file

Lines 1428-1468javascript

1428}

1429/** Return a path DuckDB can read as UTF-8: the original file when it

1430* already is UTF-8 (the cheap, common case — only the head is sniffed),

1431* else a decoded cache copy (see `decodeToCache`). Returns null when

1432* there is no readable file (missing, symlink, or containment-refused —

1433* see `safeCsvStat`), which callers render as an empty collection. */

1434async function ensureUtf8CsvPath(absPath, workspaceRoot) {

1435 const info = await safeCsvStat(absPath, workspaceRoot);

1436 if (info === null) return null;

1437 const head = await readHead(absPath, SNIFF_BYTES);

1438 const sample = head.length === SNIFF_BYTES ? head.subarray(0, 1048573) : head;

1439 if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254

1440 return decodeToCache(absPath, info);

1441}

1442var instancePromise = null;

1443/** Lazily create one shared in-memory DuckDB instance. The dynamic import

1444* keeps the native module OUT of core's load path — a platform where the

1445* prebuilt binding is missing degrades to a per-query error on dataSource

1446* collections only, never a broken core. A failed init is retried on the

1447* next call (the promise is reset). */

1448async function duckDbInstance() {

1449 if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));

1450 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-BkIKvdh0.jsView on unpkg · L1448

1451 return await instancePromise;

1452 } catch (err) {

1453 instancePromise = null;

1454 throw new BackendUnavailableError(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);

1455 }

1456}

1457async function queryCsv(sql, params) {

1458 const connection = await (await duckDbInstance()).connect();

1459 try {

1460 return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();

1461 } finally {

1462 connection.disconnectSync();

1463 }

1464}

1465async function csvList(absPath, primaryKey, workspaceRoot) {

1466 const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());

1467 if (utf8Path === null) return {

1468 items: [],

dist/skill-bridge/index.jsView file

Lines 32-72javascript

32 if (!SLUG_RE.test(slug)) return null;

33 if (!isAllowlisted(relSegments)) return null;

34 return {

dist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

dist/discovery-BkIKvdh0.jsView file

1448package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api L1448: async function duckDbInstance() { L1449: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:")); L1450: try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-BkIKvdh0.jsView on unpkg · L1448

dist/skill-bridge/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js"; import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs"; import path from "node:path"; var data_skills_dir = path.join("data", "skills"); var claude_skills_dir = path.join(".claude", "skills"); var sk[redacted] = "skill.md"; var schema_filename = "schema.json"; var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/; var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/; var recursive_flag_re = /[rr]/; function dataskilldir(workspaceroot, slug) {

Findings

3 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/discovery-BkIKvdh0.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js

HighSemantic Analysis Limiteddist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/skill-bridge/index.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mulmoclaude/core@4.9.3.

See all versions of @mulmoclaude/core for other recorded verdicts.

Review the evidence and your use of @mulmoclaude/core@4.9.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 12:46:53.228Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code