koishi-plugin-steam-friend-status-fork@0.2.9
查询群友steam状态。修改自 `koishi-plugin-steam-friend-status`
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe inspected runtime uses Steam API requests to retrieve data for bound IDs and supports status reporting through Koishi. The flagged locations did not establish credential disclosure, unauthorized account changes, or another attack behavior.
Decision evidence
public snapshot- The manifest points to lib/index.js and lists Koishi as a peer dependency; it defines no lifecycle script.
- The flagged runtime locations resolve to local avatar, nickname, and game-session handling, Steam profile lookups, and explicit plugin commands; they do not show Steam account mutations.
- Steam requests query player summaries and recently played games for Steam IDs using the configured Steam API key, and profile pages are fetched for display.
- The plugin schedules periodic status polling and sends status updates through the bot messaging API.
Source & flagged code
8 flaggedThe manifest points to lib/index.js and lists Koishi as a peer dependency; it defines no lifecycle script.
package.jsonView on unpkg · L2The manifest points to lib/index.js and lists Koishi as a peer dependency; it defines no lifecycle script.
package.jsonView on unpkg · L4Findings
Affected versions and remediation
This report applies to koishi-plugin-steam-friend-status-fork@0.2.9.
See all versions of koishi-plugin-steam-friend-status-fork for other recorded verdicts.
- Review the evidence and your use of koishi-plugin-steam-friend-status-fork@0.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.