registry / @mulmoclaude/core / 5.5.1
@mulmoclaude/core@5.5.1
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found a first-party capability that installs or updates skill files in the active Claude skills directory during runtime collection operations. With no npm lifecycle hook or evidence of covert or broad control-surface mutation, this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Use of the package's collection or skill authoring and import functionality at runtime.
Impact
A skill added through this package becomes discoverable by Claude in the project, which is a first-party agent extension setup capability.
Mechanism
The bridge copies allowlisted files for a slug from data/skills into .claude/skills; registry import and a server schema-writing operation call the mirror behavior.
AI rationale
Source inspection found a first-party capability that installs or updates skill files in the active Claude skills directory during runtime collection operations. With no npm lifecycle hook or evidence of covert or broad control-surface mutation, this warrants a warning rather than a block.
Evidence
dist/skill-bridge/index.jsdist/collection/registry/server/index.jsdist/server-BUbU9G-J.cjs.claude/skills/<slug>
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest lists build, typecheck, test, and lint scripts, with no npm install lifecycle hook in the scripts section.
- The skill bridge maps allowlisted skill files from workspace staging into the active .claude/skills tree; its targets are slug-scoped.
- Registry import selects the project skill directory and tracks whether files need mirroring.
- A server operation writes a validated schema and mirrors it into the active skill tree.
- The flagged server bundles contain project collection rendering and validation logic; the discovery bundle loads package-local modules, and the prompt safety and Google bundles contain package functionality.
Evidence against
- The bridge is runtime functionality rather than an npm lifecycle hook.
- The inspected sources do not show credential collection or an unrelated data recipient.
- The bridge targets skill files and uses an atomic write; no broad agent configuration mutation was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
4 flagged · loading sourcedist/discovery-B79IxEM6.cjsView file
1450package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api
L1450: async function duckDbInstance() {
L1451: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));
L1452: try {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/discovery-B79IxEM6.cjsView on unpkg · L1450dist/skill-bridge/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js";
import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs";
import path from "node:path";
var data_skills_dir = path.join("data", "skills");
var claude_skills_dir = path.join(".claude", "skills");
var sk[redacted] = "skill.md";
var schema_filename = "schema.json";
var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/;
var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/;
var recursive_flag_re = /[rr]/;
function dataskilldir(workspaceroot, slug) {
Findings
4 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/discovery-B79IxEM6.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js
HighSemantic Analysis Limiteddist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/google/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@5.5.1.
See all versions of @mulmoclaude/core for other recorded verdicts.
- Review the evidence and your use of @mulmoclaude/core@5.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.