registry / luckiest-co / 1.0.38
luckiest-co@1.0.38
Luckiest for Claude Code: plan, go, finish. Your luckiest.co skills and tribe, inside Claude.
AI Security Review
scanned 25d ago · by lpm-firewall-aiInspected the manifest and required source paths. The installer is not an npm install lifecycle hook, its relevant configuration behavior is bounded to Luckiest installation or prompted usage tracking, and the network activity reviewed is consistent with package features.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The installer and utility scripts run when a user invokes their CLI commands; the update notice runs as a plugin session hook.
Impact
No confirmed unauthorized credential exposure, destructive behavior, or unconsented broad agent control-surface change was established.
Mechanism
Installer configuration changes relate to installation or removal of duplicate Luckiest files, and usage tracking requires opt-in or an interactive prompt. Network activity inspected is limited to package-aligned skill or update services and X query discovery.
AI rationale
Inspected the manifest and required source paths. The installer is not an npm install lifecycle hook, its relevant configuration behavior is bounded to Luckiest installation or prompted usage tracking, and the network activity reviewed is consistent with package features.
Evidence
bin/install.jshooks/update-notice.mjsskills/luckiest-trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.js
Network endpoints2
raw.githubusercontent.com/luckiestco/luckiest-plugin/main/.claude-plugin/plugin.jsonx.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublishOnly version check; the installer is exposed as a CLI bin, not an npm lifecycle hook.
- bin/install.js removes duplicate skill copies only when the Luckiest marketplace plugin already provides them; usage-hook setup is opt-in or prompted.
- bin/sync-plugin-repo.js runs git/gh operations only when explicitly invoked as a command-line script.
- The required QA, graph-rendering, and query-ID files contain tooling for their named tasks; their file writes and network requests are task-specific.
- hooks/update-notice.mjs checks the package-aligned public plugin manifest and prints an update notice; it does not transmit credentials.
- The brainstorming server listens on its configured host and port and stores its server state locally.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
11 flaggedbin/sync-plugin-repo.jsView file
6L7: const { execFileSync } = require('child_process');
L8: const fs = require('fs');
High
Child Process
Package source references child process execution.
bin/sync-plugin-repo.jsView on unpkg · L6skills/luckiest-video-studio/scripts/qa.mjsView file
504passes = prompts.map((p, i) => {
L505: const r = spawnSync(opt("--cmd"), { shell: true, input: p, encoding: "utf8", maxBuffer: 1 << 26 });
L506: writeFileSync(join(out, `pass${i + 1}.txt`), (r.stdout ?? "") + (r.stderr ?? ""));
High
Shell
Package source references shell execution.
skills/luckiest-video-studio/scripts/qa.mjsView on unpkg · L504skills/luckiest-coder-brainstorming/scripts/server.cjsView file
Findings
9 High4 Medium7 Low
HighChild Processbin/sync-plugin-repo.js
HighShellskills/luckiest-video-studio/scripts/qa.mjs
HighSame File Env Network Executionbin/install.js
HighExternal Ai Agent Control Surface Mutationhooks/update-notice.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighSemantic Analysis Limitedskills/luckiest-coder-brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similarityskills/luckiest-coder-writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/luckiest-trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.js
HighPrevious Version Dangerous Deltaskills/luckiest-coder-brainstorming/scripts/server.cjs
Medium
Affected versions and remediation
This report applies to luckiest-co@1.0.38.
See all versions of luckiest-co for other recorded verdicts.
- Review the evidence and your use of luckiest-co@1.0.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.