registry / @unoverse-platform/plugin-base / 1.2.2

@unoverse-platform/plugin-base@1.2.2

Base package for Unoverse plugin development

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The only network-capable path is an explicit runtime MCP component-app invocation using caller-provided context.

Static reason

One or more suspicious static signals were detected.

Trigger

A host application explicitly calls `invokeComponentAppNative` through the exported component-app invoker.

Impact

Sends the supplied tool arguments and optional supplied bearer token to the caller-selected MCP endpoint; no automatic execution or persistence is established.

Mechanism

Runtime MCP client request to the configured Unoverse service.

Rationale

The package is a plugin/MCP base library with no lifecycle hooks or import-time side effects. Its network behavior is explicit runtime platform functionality, and the flagged AWS strings are credential-field placeholders rather than secrets or exfiltration.

Evidence

package.jsondist/agent-mcp/index.jsdist/credentials/aws.jsdist/credentials/openai.jsagent-mcp.jsdist/index.jsdist/credentials/index.jsdist/inputs.jsdist/types.jsREADME.md

Network endpoints2

localhost:4106/mcpapi.openai.com/v1

@unoverse-platform/plugin-base@1.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code