@remixmate/cli@0.13.5
AI media generation skills for Claude Code / Codex — 12 skills covering image, video, voice, digital human, web screenshot, web recording, script, template registry, rendering, Jianying export, and video deconstruction.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest has no install hook, and inspected runtime network and process behavior is tied to the CLI’s stated functions and user-invoked commands. The scanner’s command-output exfiltration signal is not supported: the doctor probes local command output for display, while its backend request contains a fixed client label.
Decision evidence
public snapshot- package.json exposes dist/cli.js as the CLI and has no lifecycle scripts.
- The credential verification request sends a token to the configured API base URL; whoami invokes it after resolving credentials for that same URL.
- Login obtains a token through an explicit device authorization flow, while exec injects credentials only when the user supplies a command after the separator.
- Update checks use the npm registry setting or the standard npm registry and cache version metadata locally.
- Doctor runs bounded local environment probes and sends only a client label to the configured Remixmate backend for its reachability check.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/update-check.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @remixmate/cli@0.13.5.
See all versions of @remixmate/cli for other recorded verdicts.
- Review the evidence and your use of @remixmate/cli@0.13.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.