registry / @unoverse-platform/plugin-base / 1.2.0

@unoverse-platform/plugin-base@1.2.0

Base package for Unoverse plugin development

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Importing the package defines classes, helpers, and declarative credential/MCP metadata only; platform operations remain caller-provided references.

Static reason

One or more suspicious static signals were detected.

Trigger

Package import or explicit plugin setup/API use.

Impact

No install-time execution, credential harvesting, exfiltration, persistence, destructive action, or remote payload execution is established.

Mechanism

Exports plugin utilities and transforms supplied MCP result data.

Rationale

The scanner's critical-secret signal is a false positive: the matched AWS values are standard example placeholders in a credential-definition object. Direct inspection found no lifecycle hook or concrete malicious behavior.

Evidence

package.jsondist/index.jsdist/agent-mcp/index.jsdist/credentials/aws.jsdist/credentials/openai.jsagent-mcp.jsdist/credentials/index.jsdist/types.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

@unoverse-platform/plugin-base@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code