registry / @mulmoclaude/core / 5.7.0

@mulmoclaude/core@5.7.0

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The inspected source supports ordinary package behavior, with no install-time trigger or concrete attack chain. The skill mirroring is workspace-scoped and tied to explicit registry or authoring operations.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A caller invokes a registry import or skill authoring operation.

Impact

No confirmed malicious effect or attack surface was established.

Mechanism

The bridge mirrors allowlisted files for a skill slug into the workspace’s .claude/skills directory; package.json shows no install lifecycle script that invokes it.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes build, typecheck, test, and lint scripts, with no install lifecycle script in its scripts block.
The skill bridge limits mirrored files to named skill files and safe action templates, and targets the workspace’s .claude/skills directory.
Registry mirroring handles a specific skill slug and allowlisted bundle files; the inspected source shows no package-install trigger for that operation.
The Google broker uses a package-aligned default endpoint and permits a configurable override; the inspected URL validation requires HTTPS or loopback.
The discovery and prompt-safety files inspected show ordinary local module imports, not a runtime dependency bridge or an attack.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Source & flagged code

4 flagged

dist/discovery-CwBXvtyn.cjsView file

Lines 1430-1470javascript

1430}

1431/** Return a path DuckDB can read as UTF-8: the original file when it

1432* already is UTF-8 (the cheap, common case — only the head is sniffed),

1433* else a decoded cache copy (see `decodeToCache`). Returns null when

1434* there is no readable file (missing, symlink, or containment-refused —

1435* see `safeCsvStat`), which callers render as an empty collection. */

1436async function ensureUtf8CsvPath(absPath, workspaceRoot) {

1437 const info = await safeCsvStat(absPath, workspaceRoot);

1438 if (info === null) return null;

1439 const head = await readHead(absPath, SNIFF_BYTES);

1440 const sample = head.length === SNIFF_BYTES ? head.subarray(0, 1048573) : head;

1441 if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254

1442 return decodeToCache(absPath, info);

1443}

1444var instancePromise = null;

1445/** Lazily create one shared in-memory DuckDB instance. The dynamic import

1446* keeps the native module OUT of core's load path — a platform where the

1447* prebuilt binding is missing degrades to a per-query error on dataSource

1448* collections only, never a broken core. A failed init is retried on the

1449* next call (the promise is reset). */

1450async function duckDbInstance() {

1451 if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));

1452 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-CwBXvtyn.cjsView on unpkg · L1450

1453 return await instancePromise;

1454 } catch (err) {

1455 instancePromise = null;

1456 throw new BackendUnavailableError(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);

1457 }

1458}

1459async function queryCsv(sql, params) {

1460 const connection = await (await duckDbInstance()).connect();

1461 try {

1462 return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();

1463 } finally {

1464 connection.disconnectSync();

1465 }

1466}

1467async function csvList(absPath, primaryKey, workspaceRoot) {

1468 const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());

1469 if (utf8Path === null) return {

1470 items: [],

dist/skill-bridge/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js"; import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs"; import path from "node:path"; var data_skills_dir = path.join("data", "skills"); var claude_skills_dir = path.join(".claude", "skills"); var sk[redacted] = "skill.md"; var schema_filename = "schema.json"; var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/; var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/; var recursive_flag_re = /[rr]/; function dataskilldir(workspaceroot, slug) {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/skill-bridge/index.jsView on unpkg

dist/promptSafety-BGV1wrE6.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/promptSafety-BGV1wrE6.cjs#virtual:normalized:round1View on unpkg

dist/google/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mulmoclaude/core@4.9.3 matchedIdentity = npm:QG11bG1vY2xhdWRlL2NvcmU:4.9.3 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/google/index.cjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/discovery-CwBXvtyn.cjsView file

1450package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api L1450: async function duckDbInstance() { L1451: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:")); L1452: try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-CwBXvtyn.cjsView on unpkg · L1450

dist/skill-bridge/index.jsView file

Findings

4 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/discovery-CwBXvtyn.cjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js

HighSemantic Analysis Limiteddist/promptSafety-BGV1wrE6.cjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/google/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mulmoclaude/core@5.7.0.

See all versions of @mulmoclaude/core for other recorded verdicts.

Review the evidence and your use of @mulmoclaude/core@5.7.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 06:46:18.316Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.