registry / @mutmutco/claude-plugin / 4.5.169
@mutmutco/claude-plugin@4.5.169
MMI workflow skills and org gates delivery.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the reviewed agent configuration code only classifies untracked paths for clean-tree checks. The GitHub token transfer is part of the CLI's Hub session-authentication flow; the inspected source did not establish unrelated collection or exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs a command that requests a Hub session.
Impact
No confirmed credential theft, agent control hijack, or other attack effect was established.
Mechanism
It sends a GitHub bearer token to the Hub authentication endpoint and uses the returned session. Agent configuration paths are treated as exempt untracked paths in clean-tree checks.
AI rationale
The manifest has no install lifecycle hook, and the reviewed agent configuration code only classifies untracked paths for clean-tree checks. The GitHub token transfer is part of the CLI's Hub session-authentication flow; the inspected source did not establish unrelated collection or exfiltration.
Evidence
package.jsoncli/dist/main.cjs
Network endpoints1
tqxxwzftic.execute-api.eu-central-1.amazonaws.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest defines no lifecycle scripts and packages the plugin CLI.
- The flagged agent paths are used to exempt untracked agent configuration and session files from Git-clean-tree blocking checks.
- The CLI uses an MMI Hub URL, with an environment override and a built-in endpoint.
- The CLI sends a GitHub token to the Hub's /auth/session endpoint to obtain a Hub session.
- The source classifies agent configuration paths as exempt only for untracked files.
Evidence against
- A GitHub token is transmitted to the Hub during session authentication; the inspected code shows an authentication exchange, not unrelated credential collection or exfiltration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcecli/dist/main.cjsView file
39Source sends the broad process environment to a literal external destination.
L39: function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve7());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve7) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
cli/dist/main.cjsView on unpkg · L3939function globalDispatcher() {
L40: return globalThis[UNDICI_GLOBAL_DISPATCHER_SYMBOL];
L41: }
...
L80: try {
L81: stream.write("", () => resolve7());
L82: } catch {
...
L88: await Promise.race([
L89: Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
L90: new Promise((resolve7) => {
...
L140: CLI_EXIT_WATCHDOG_MS = (() => {
L141: const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
L142: return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli/dist/main.cjsView on unpkg · L39Findings
2 Critical3 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli/dist/main.cjs
CriticalCredential Exfiltrationcli/dist/main.cjs
HighChild Processcli/dist/main.cjs
HighCommand Output Exfiltrationcli/dist/main.cjs
HighSemantic Analysis Limitedcli/dist/main.cjs
MediumDynamic Requirecli/dist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/mmi-cli.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @mutmutco/claude-plugin@4.5.169.
See all versions of @mutmutco/claude-plugin for other recorded verdicts.
- Review the evidence and your use of @mutmutco/claude-plugin@4.5.169 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.