registry / @riddledc/riddle-proof-riddle-client / 0.4.3

@riddledc/riddle-proof-riddle-client@0.4.3

Hosted Riddle API client and job polling helpers for Proof workflows.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

An explicitly invoked runtime bridge can execute a supplied local shell command and supplied browser script, and can upload a caller-selected project directory for hosted previews. No install-time execution or persistence was found.

Static reason

No blocking static signals were detected.

Trigger

User or agent invokes runtime/riddle_core_call.mjs with riddle_server_preview, riddle_script, or riddle_run.

Impact

A compromised caller or agent can execute commands in its existing privileges and transmit selected project files.

Mechanism

Caller-controlled shell/browser execution and hosted preview upload.

Rationale

This is an intentionally capability-rich hosted browser/preview client, but its exposed runtime offers caller-controlled shell and script execution. The risk warrants a warning rather than a block because activation is explicit and no malicious install-time behavior was found.

Evidence

package.jsonruntime/riddle_core_call.mjsdist/chunk-YMNWPE7N.jscapabilities.json

Network endpoints3

api.riddledc.com/v1/runapi.riddledc.com/v1/previewapi.riddledc.com/v1/server-preview

Decision evidence

public snapshot

@riddledc/riddle-proof-riddle-client@0.4.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code