registry / AI-agent capability abuse / @mulmoclaude/core / 5.6.0

@mulmoclaude/core@5.6.0

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The source shows a user-invoked registry import that can add skill content to `.claude/skills`, creating an agent capability risk. No automatic lifecycle mutation or concrete malicious behavior was established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A caller invokes the registry import operation.

Impact

Imported skill content may influence later Claude behavior when the skill is used; the inspected code does not establish a malicious payload or automatic install trigger.

Mechanism

The importer fetches and validates a skill bundle, writes it to the workspace, and mirrors selected files into `.claude/skills`.

AI rationale

Evidence

dist/collection/registry/server/index.jsdist/collection/registry/server/index.cjsdist/skill-bridge/index.jsdist/skill-bridge/index.cjs.claude/skills/<slug>/data/skills/<slug>/

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json lists build, typecheck, test, and lint scripts, with no install lifecycle hook.
The registry importer writes validated bundle files into workspace skill directories and mirrors selected files into `.claude/skills`.
The skill bridge targets `.claude/skills` and copies staged skill content there; the server bundles describe imported skills and their views.
The Google entrypoint loads ordinary library dependencies; the inspected excerpt shows no install-time action.

Evidence against

The import code can place registry-provided skill content in Claude’s discoverable skill directory, which can affect later agent behavior when a user invokes the import feature.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

Source & flagged code

4 flagged

dist/discovery-B79IxEM6.cjsView file

Lines 1430-1470javascript

1430}

1431/** Return a path DuckDB can read as UTF-8: the original file when it

1432* already is UTF-8 (the cheap, common case — only the head is sniffed),

1433* else a decoded cache copy (see `decodeToCache`). Returns null when

1434* there is no readable file (missing, symlink, or containment-refused —

1435* see `safeCsvStat`), which callers render as an empty collection. */

1436async function ensureUtf8CsvPath(absPath, workspaceRoot) {

1437 const info = await safeCsvStat(absPath, workspaceRoot);

1438 if (info === null) return null;

1439 const head = await readHead(absPath, SNIFF_BYTES);

1440 const sample = head.length === SNIFF_BYTES ? head.subarray(0, 1048573) : head;

1441 if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254

1442 return decodeToCache(absPath, info);

1443}

1444var instancePromise = null;

1445/** Lazily create one shared in-memory DuckDB instance. The dynamic import

1446* keeps the native module OUT of core's load path — a platform where the

1447* prebuilt binding is missing degrades to a per-query error on dataSource

1448* collections only, never a broken core. A failed init is retried on the

1449* next call (the promise is reset). */

1450async function duckDbInstance() {

1451 if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));

1452 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-B79IxEM6.cjsView on unpkg · L1450

1453 return await instancePromise;

1454 } catch (err) {

1455 instancePromise = null;

1456 throw new BackendUnavailableError(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);

1457 }

1458}

1459async function queryCsv(sql, params) {

1460 const connection = await (await duckDbInstance()).connect();

1461 try {

1462 return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();

1463 } finally {

1464 connection.disconnectSync();

1465 }

1466}

1467async function csvList(absPath, primaryKey, workspaceRoot) {

1468 const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());

1469 if (utf8Path === null) return {

1470 items: [],

dist/skill-bridge/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js"; import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs"; import path from "node:path"; var data_skills_dir = path.join("data", "skills"); var claude_skills_dir = path.join(".claude", "skills"); var sk[redacted] = "skill.md"; var schema_filename = "schema.json"; var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/; var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/; var recursive_flag_re = /[rr]/; function dataskilldir(workspaceroot, slug) {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/skill-bridge/index.jsView on unpkg

dist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1View on unpkg

dist/google/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mulmoclaude/core@4.9.3 matchedIdentity = npm:QG11bG1vY2xhdWRlL2NvcmU:4.9.3 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/google/index.cjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/discovery-B79IxEM6.cjsView file

1450package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api L1450: async function duckDbInstance() { L1451: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:")); L1452: try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-B79IxEM6.cjsView on unpkg · L1450

dist/skill-bridge/index.jsView file

Findings

4 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/discovery-B79IxEM6.cjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js

HighSemantic Analysis Limiteddist/promptSafety-caJWd1ZQ.cjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/google/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mulmoclaude/core@5.6.0.

See all versions of @mulmoclaude/core for other recorded verdicts.

Review the evidence and your use of @mulmoclaude/core@5.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 06:46:12.510Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code