registry / koishi-plugin-smmcat-yeyechat / 0.1.35
koishi-plugin-smmcat-yeyechat@0.1.35
名为【夜夜酱】的聊天系统
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected runtime code performs plugin setup and configured chat or image API calls. The runtime hints resolve to memory formatting and persona setup; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
The plugin runs when loaded by Koishi; image recognition requires configured vision settings and image input.
Impact
No unconsented credential transfer, destructive action, persistence, or other concrete attack was established.
Mechanism
The inspected code formats memory for display, initializes plugin commands, and sends configured API requests for chat or image recognition.
AI rationale
The manifest has no install hook, and the inspected runtime code performs plugin setup and configured chat or image API calls. The runtime hints resolve to memory formatting and persona setup; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to lib/index.js and declares no lifecycle scripts or runtime dependencies beyond Koishi.
- The primary chat API base URL and token are empty by default and are supplied through plugin configuration.
- Image recognition sends images and a configured vision token to the configured vision API; it is skipped unless the URL, token, and model are present.
- The cited runtime locations format user memory and initialize commands; startup replacement only updates the configured persona.
Evidence against
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "koishi-plugin-smmcat-yeyechat",
"description": "名为【夜夜酱】的聊天系统",
"version": "0.1.35",
"main": "lib/index.js",
"typings": "lib/index.d.ts",
"files": [
"lib",
"dist"
],
"license": "MIT",
"keywords": [
"chatbot",
"koishi",
"plugin"
],
"peerDependencies": {
"koishi": "^4.18.7"
}
}
Low
Suspicious Lifecycle Evidence
package.json points to lib/index.js and declares no lifecycle scripts or runtime dependencies beyond Koishi.
package.jsonView on unpkg · L1lib/index.jsView file
2682var Config = import_koishi4.Schema.object({
baseUrl: import_koishi4.Schema.string().default("").description("接口基础地址"),
token: import_koishi4.Schema.string().default("").description("接口令牌"),
model: import_koishi4.Schema.string().default("").description("模型名称"),
deBug: import_koishi4.Schema.boolean().default(false).description("是否开启调试模式"),
useMd: import_koishi4.Schema.boolean
Low
Ai Review Evidence
The primary chat API base URL and token are empty by default and are supplied through plugin configuration.
lib/index.jsView on unpkg · L2682Findings
1 Medium11 Low
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.35.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.