registry / @unoverse-platform/plugin-base / 1.2.3

@unoverse-platform/plugin-base@1.2.3

Base package for Unoverse plugin development

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The optional agent-MCP entrypoint can call a configured platform MCP endpoint and pass a caller Bearer token. It is dormant on package import and requires runtime invocation.

Static reason

One or more suspicious static signals were detected.

Trigger

A host application invokes `invokeComponentAppNative` or a generated component-app invoker.

Impact

A compromised or misconfigured service URL could receive the supplied token and tool-call context.

Mechanism

Dynamic MCP client call with configurable service URL and forwarded access token.

Rationale

No concrete malicious chain was found. The exported agent-MCP lifecycle function nonetheless forwards privileged context to a configurable endpoint, so it warrants a warning as a guarded platform extension capability.

Evidence

package.jsonagent-mcp.jsdist/agent-mcp/index.jsdist/credentials/aws.jsdist/credentials/openai.jsdist/index.jsdist/credentials/index.jsdist/inputs.jsdist/types.jsREADME.md

Network endpoints1

localhost:4106/mcp

@unoverse-platform/plugin-base@1.2.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code