registry / @mulmoclaude/core / 5.5.0
@mulmoclaude/core@5.5.0
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe flagged agent configuration behavior is scoped to the package’s collection skill authoring and import workflow, with workspace path and file allowlisting. Inspected evidence did not establish install-hook activation, broad unrelated agent configuration changes, credential exposure, or another concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A collection authoring or import operation in the consuming application.
Impact
The operation makes authored or imported collection skills available to the application’s Claude integration; no harmful control change was established.
Mechanism
Validated skill files from workspace staging are mirrored into that workspace’s .claude/skills directory; schema mirroring follows a schema write.
AI rationale
The flagged agent configuration behavior is scoped to the package’s collection skill authoring and import workflow, with workspace path and file allowlisting. Inspected evidence did not establish install-hook activation, broad unrelated agent configuration changes, credential exposure, or another concrete attack.
Evidence
.claude/skills/<slug>
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies this as a shared MulmoClaude and MulmoTerminal core package.
- The registry import behavior installs skills under the active .claude/skills directory when no staging bridge exists; with staging, skill files are mirrored into that directory.
- The skill bridge limits mirrored paths to validated skill slugs and allowed files under the workspace staging directory.
- Schema mirroring is tied to a schema write operation in the collection server, consistent with package-owned collection authoring.
- The flagged server bundle excerpts describe source-aware collection view handling; the flagged discovery, prompt safety, and Google files inspected begin with ordinary module imports.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flagged · loading sourcedist/discovery-B79IxEM6.cjsView file
1450package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api
L1450: async function duckDbInstance() {
L1451: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));
L1452: try {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/discovery-B79IxEM6.cjsView on unpkg · L1450dist/skill-bridge/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js";
import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs";
import path from "node:path";
var data_skills_dir = path.join("data", "skills");
var claude_skills_dir = path.join(".claude", "skills");
var sk[redacted] = "skill.md";
var schema_filename = "schema.json";
var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/;
var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/;
var recursive_flag_re = /[rr]/;
function dataskilldir(workspaceroot, slug) {
Findings
4 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/discovery-B79IxEM6.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js
HighSemantic Analysis Limiteddist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/google/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@5.5.0.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@5.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.