koishi-plugin-smmcat-yeyechat@0.1.43
名为【夜夜酱】的聊天系统
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged credential flows use feature-specific tokens with configurable AI service endpoints, and image recognition is skipped unless its required settings are present. Network access and image storage are consistent with the package’s chatbot purpose; no malicious behavior was identified.
Decision evidence
public snapshot- The package identifies lib/index.js as its entry point and declares no lifecycle scripts in package.json.
- Image recognition requires a configured vision endpoint, token and model; without them, the feature returns without calling the service.
- The vision request sends an image to the configured API base with the configured vision token, matching the package’s image-recognition feature.
- DeepSeek search requires a configured token and uses the configured official API base when the web_search tool runs.
- Image files are saved under the configured image directory when messages containing images are processed.
Source & flagged code
5 flaggedThe package identifies lib/index.js as its entry point and declares no lifecycle scripts in package.json.
package.jsonView on unpkg · L2Image recognition requires a configured vision endpoint, token and model; without them, the feature returns without calling the service.
lib/index.jsView on unpkg · L120Findings
Affected versions and remediation
This report applies to koishi-plugin-smmcat-yeyechat@0.1.43.
See all versions of koishi-plugin-smmcat-yeyechat for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-smmcat-yeyechat@0.1.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.