registry / luckiest-co / 1.0.31
luckiest-co@1.0.31
Luckiest for Claude Code: plan, go, finish. Your luckiest.co skills and tribe, inside Claude.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle script, and the CLI’s only identified agent settings registration requires user consent. The flagged source excerpts are consistent with the package’s described CLI and skill tooling; they do not establish malicious behavior.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running the CLI; the usage hook is registered only after explicit opt-in.
Impact
No confirmed harmful effect or unconsented agent configuration change was established.
Mechanism
The installer prompts before changing settings and declines when it cannot ask; the hook records skill usage. The inspected flagged files perform video QA, update checking, local server startup, diagram parsing, and X query-ID caching.
AI rationale
The manifest has no install lifecycle script, and the CLI’s only identified agent settings registration requires user consent. The flagged source excerpts are consistent with the package’s described CLI and skill tooling; they do not establish malicious behavior.
Network endpoints1
raw.githubusercontent.com/luckiestco/luckiest-plugin/main/.claude-plugin/plugin.json
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and declares no install lifecycle hook.
- The installer’s settings hook requires an explicit flag or affirmative prompt; without a terminal it declines.
- The hook is added to the user’s Claude settings only after consent.
- The flagged installer location removes duplicate Luckiest commands only when the Luckiest marketplace plugin is present.
- The video QA script imports filesystem and child-process tools for its video checks.
- The update notice fetches the Luckiest plugin’s public manifest, subject to a configurable manifest URL.
- The brainstorming server starts only when run as the main module; the graph renderer parses diagram blocks; the flagged vendor file initializes an X query-ID cache.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
11 flaggedbin/install.jsView file
10const readline = require('readline');
L11: const { execFileSync } = require('child_process');
L12:
High
187function apiBaseUrl() {
L188: return (process.env.LUCKIEST_API_URL || 'https://api.luckiest.co').replace(/\/$/, '');
L189: }
...
L192: try {
L193: execFileSync('unzip', ['-v'], { stdio: 'ignore' });
L194: return true;
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/install.jsView on unpkg · L187•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
ly = args.includes('--sync-only');
const hashook = args.includes('--hook');
const hasnohook = args.includes('--no-hook');
function parseconfigdirarg() {
const configdirindex = args.findindex(arg => arg === '--config-dir' || arg === '-c');
if (configdirindex !== -1) {
const nextarg = args[configdirindex + 1];
if (!nextarg || nextarg.startswith('-')) {
console.error(` ${yellow}--config-dir requires a path argument
Findings
9 High4 Medium5 Low
HighChild Processbin/install.js
HighShellskills/luckiest-video-studio/scripts/qa.mjs
HighSame File Env Network Executionbin/install.js
HighExternal Ai Agent Control Surface Mutationhooks/update-notice.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighSemantic Analysis Limitedskills/luckiest-coder-brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similarityskills/luckiest-coder-writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/luckiest-trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.js
HighPrevious Version Dangerous Deltaskills/luckiest-coder-brainstorming/scripts/server.cjs
Medium
Affected versions and remediation
This report applies to luckiest-co@1.0.31.
See all versions of luckiest-co for other recorded verdicts.
- Review the evidence and your use of luckiest-co@1.0.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.