koishi-plugin-smmcat-yeyechat@0.1.38
名为【夜夜酱】的聊天系统
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the inspected runtime operations support chat and configured image recognition. The vision token is a dedicated setting, defaults to empty, and is used with the configured vision endpoint; no unrelated credential transfer or other concrete attack behavior was found.
Decision evidence
public snapshot- The manifest identifies lib/index.js as the runtime entry point and contains no lifecycle scripts.
- The flagged runtime operations format user preference and memory data; startup registers chat controls and initializes the chat component.
- Image recognition requires image input and configured vision settings. It sends the image and the dedicated vision token to the configured Gemini-compatible API endpoint.
- The vision token defaults to empty, and image recognition is skipped unless the token, endpoint, and model are configured.
Source & flagged code
8 flaggedThe manifest identifies lib/index.js as the runtime entry point and contains no lifecycle scripts.
package.jsonView on unpkg · L1The flagged runtime operations format user preference and memory data; startup registers chat controls and initializes the chat component.
lib/index.jsView on unpkg · L580Findings
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.38.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.