registry / koishi-plugin-smmcat-yeyechat / 0.1.36
koishi-plugin-smmcat-yeyechat@0.1.36
名为【夜夜酱】的聊天系统
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe inspected source supports a chatbot plugin with configurable model integrations and permission-checked moderation tools. No install hook, credential harvesting, or unrelated credential recipient was found.
Static reason
No blocking static signals were detected.
Trigger
Koishi loads the plugin; chat or an enabled feature triggers requests.
Impact
No unauthorized credential transfer or publisher-selected account action was established.
Mechanism
The plugin sends model requests to configured service endpoints and registers interactive commands; moderation actions have permission checks.
AI rationale
The inspected source supports a chatbot plugin with configurable model integrations and permission-checked moderation tools. No install hook, credential harvesting, or unrelated credential recipient was found.
Evidence
package.jsonlib/index.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to lib/index.js and declares no lifecycle scripts; Koishi is a peer dependency.
- The runtime hint locations format relationship summaries and memories, register plugin commands, and initialize the plugin.
- Chat requests use the configured base URL and token, both blank by default.
- Web search and page retrieval use the configured official DeepSeek API setting.
- Moderation tools are withheld from non-admin bots, and the mute handler checks the requesting user's permissions.
Evidence against
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "koishi-plugin-smmcat-yeyechat",
"description": "名为【夜夜酱】的聊天系统",
"version": "0.1.36",
"main": "lib/index.js",
"typings": "lib/index.d.ts",
"files": [
"lib",
"dist"
],
"license": "MIT",
"keywords": [
"chatbot",
"koishi",
"plugin"
],
"peerDependencies": {
"koishi": "^4.18.7"
}
}
Low
Suspicious Lifecycle Evidence
The manifest points to lib/index.js and declares no lifecycle scripts; Koishi is a peer dependency.
package.jsonView on unpkg · L1lib/index.jsView file
580data.likes.join("、") : "还没有记录"}`,
`关于你的记忆：${formatMemories(data.longMemory)}`
].join("\n");
}
__name(buildRe
Low
Ai Review Evidence
The runtime hint locations format relationship summaries and memories, register plugin commands, and initialize the plugin.
lib/index.jsView on unpkg · L580587memories.map((m) => `${m.id}. ${m.content}`).join("\n");
}
__name(formatMemories, "formatMemories");
function parseAttributeBlock(text) {
Findings
1 Medium11 Low
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.36.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.