registry / creditgauge / 1.1.0

creditgauge@1.1.0

Claude Code statusline plugin (CreditGauge) for MiniMax/DeepSeek token-plan usage and account balance. Ships an `npx creditgauge` TUI for install/uninstall/clean/diagnostics.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The Claude Code statusline dynamically loads package-owned query-plugin extensions and passes the configured provider token to them. Explicit installation changes Claude Code settings to invoke the package wrapper.

Static reason

No blocking static signals were detected.

Trigger

Claude Code runs the configured statusline, or a user runs `npx creditgauge install`.

Impact

A malicious local CreditGauge query plugin can execute in the Claude Code process and receive the configured provider credential.

Mechanism

Dynamic local query-plugin loading with provider-token delegation.

Rationale

This is not concrete malware, but it establishes a first-party Claude Code extension lifecycle with dynamic local code loading and credential delegation. Per policy, retain a warn verdict for this agent-extension risk rather than blocking publication.

Evidence

package.jsonbin/cli.jsdist/index.jsdist/plugins/minimax/index.jsdist/plugins/deepseek/index.jsscripts/install.shscripts/uninstall.shscripts/lib/edit-settings.mjs~/.claude/settings.json~/.claude/plugins/creditgauge/query_plugins

Network endpoints2

creditgauge@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code