registry / @seastudio/sdk / 7.2.2

@seastudio/sdk@7.2.2

SeaStudio SDK - plugin runtime contracts, host-tool communication, MCP, and artifact tooling

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Explicit `seastudio` commands package a user-selected artifact, optionally build its frontend, and send an install/remove request to the package-aligned SeaStudio Desktop local IPC endpoint.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User explicitly runs `seastudio plugin install/remove` or `seastudio skill install/remove`.

Impact

Can install or remove the user-selected SeaStudio plugin or skill; no unconsented install-time execution or exfiltration is established.

Mechanism

User-invoked artifact packaging and local SeaStudio Desktop IPC.

Rationale

The flagged primitives are explicit CLI functionality for SeaStudio artifact installation and package-aligned local IPC. Static inspection found no lifecycle-triggered execution, external network endpoint, credential collection, remote payload execution, or foreign AI-agent control-surface mutation.

Evidence

package.jsonbin/seastudio.mjsdist/desktop-cli/cli.cjsdist/chunk-3ELW7TR6.cjsdist/chunk-ZFE3SFAS.cjs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

@seastudio/sdk@7.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code