registry / @seastudio/sdk / 7.3.0

@seastudio/sdk@7.3.0

SeaStudio SDK - plugin runtime contracts, host-tool communication, MCP, and artifact tooling

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `seastudio plugin install`, `seastudio skill install`, or the corresponding remove command.

Impact

Can install or remove a selected SeaStudio plugin/skill; plugin install can execute that selected plugin's declared frontend build command.

Mechanism

Explicit local agent-extension packaging and Desktop CLI RPC mutation.

Rationale

No concrete malicious behavior was found, but the explicit CLI manages AI/agent-style plugin and skill installation and can run a selected project's build script. Downgrade to warn under the extension-control policy rather than block.

Evidence

package.jsonbin/seastudio.mjsdist/desktop-cli/cli.cjsdist/chunk-3ELW7TR6.cjsdist/chunk-GZMQWI4X.cjsdist/plugin-artifact/cli.cjs.codex-plugin/plugin.jsonfrontend/package.jsonfrontend/distSKILL.md

Decision evidence

public snapshot

@seastudio/sdk@7.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code