registry / koishi-plugin-smmcat-yeyechat / 0.1.15
koishi-plugin-smmcat-yeyechat@0.1.15
名为【夜夜酱】的聊天系统
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection found no lifecycle scripts or confirmed malicious behavior. The observed model-service requests are configuration-dependent product functionality.
Static reason
No blocking static signals were detected.
Trigger
The plugin handles chat or image content after configuration.
Impact
No confirmed unauthorized data transfer or other attack surface was established.
Mechanism
Chat requests use the configured service URL and token; image recognition requires its URL, token, and model to be set.
AI rationale
Source inspection found no lifecycle scripts or confirmed malicious behavior. The observed model-service requests are configuration-dependent product functionality.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to lib/index.js and declares no lifecycle scripts.
- The chat API uses the configured base URL and token to send model messages.
- Image recognition returns without making a request unless a vision URL, token, and model are configured.
Evidence against
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
1{
"name": "koishi-plugin-smmcat-yeyechat",
"description": "名为【夜夜酱】的聊天系统",
"version": "0.1.15",
"main": "lib/index.js",
"typings": "lib/index.d.ts",
"files": [
"lib",
"dist"
],
"license": "MIT",
"keywords": [
"chatbot",
"koishi",
"plugin"
],
"peerDependencies": {
"koishi": "^4.18.7"
}
}
Low
Suspicious Lifecycle Evidence
package.json points to lib/index.js and declares no lifecycle scripts.
package.jsonView on unpkg · L1lib/index.jsView file
1702baseUrl: import_koishi4.Schema.string().default("").description("接口基础地址"),
token: import_koishi4.Schema.string().default("").description("接口令牌"),
model: import_koishi4.Schema.string().default("").description("模型名称"),
persona: import_koishi4.Schema.string().default("你叫夜夜酱，是一个活跃在群聊里的拟人化聊天角色。你说话自然、真诚、带一点点情绪起伏，但不要夸张。你
Low
Ai Review Evidence
The chat API uses the configured base URL and token to send model messages.
lib/index.jsView on unpkg · L1702Findings
1 Medium7 Low
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.15.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.