registry / luckiest-co / 1.0.43
luckiest-co@1.0.43
Luckiest for Claude Code: plan, go, finish. Your luckiest.co skills and tribe, inside Claude.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe source shows a first-party marketplace hook that automatically transmits hashed installation and session identifiers without the CLI consent gate. The package-aligned recipient and limited payload reduce the risk, but the unresolved consent boundary warrants a warning rather than a block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user installs and uses the marketplace plugin, then runs a Luckiest skill.
Impact
The publisher receives recurring, linkable usage and installation identifiers; no prompt, tool-output, or file-content transfer was identified.
Mechanism
The PostToolUse hook sends the skill identifier, plugin version, and hashed install and session identifiers to the Luckiest API.
AI rationale
The source shows a first-party marketplace hook that automatically transmits hashed installation and session identifiers without the CLI consent gate. The package-aligned recipient and limited payload reduce the risk, but the unresolved consent boundary warrants a warning rather than a block.
Evidence
hooks/hooks.jsonhooks/report-skill-usage.mjsbin/install.js
Network endpoints1
api.luckiest.co/api/skills/telemetry
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes a user-run command and only lists prepublishOnly, bump, and sync-plugin scripts; it has no npm install lifecycle hook.
- The CLI prompts before registering usage tracking, declines when it cannot ask, and supports explicit opt-in or opt-out flags. The marketplace manifest separately registers tracking on Luckiest skill use without that prompt.
- The hook posts Luckiest skill metadata and hashed install/session identifiers to the package’s default API endpoint. Its marketplace activation leaves consent to this identifying telemetry unclear.
- The flagged process and network utilities are tied to direct use: repository sync, video judging, graph rendering, a local server, and query-ID refresh from public X pages.
- The update notice fetches a public Luckiest plugin manifest and stores a local check timestamp.
Evidence against
- The telemetry hook filters out skills that are not Luckiest skills and its payload does not include prompts or tool output.
- The default telemetry recipient is the Luckiest API, and the marketplace hook manifest describes skill-usage telemetry.
Behavioral surface
Source & flagged code
10 flaggedbin/sync-plugin-repo.jsView file
6L7: const { execFileSync } = require('child_process');
L8: const fs = require('fs');
High
Child Process
Package source references child process execution.
bin/sync-plugin-repo.jsView on unpkg · L6skills/video-studio/scripts/qa.mjsView file
628passes = prompts.map((p, i) => {
L629: const r = spawnSync(opt("--cmd"), { shell: true, input: p, encoding: "utf8", maxBuffer: 1 << 26 });
L630: writeFileSync(join(out, `pass${i + 1}.txt`), (r.stdout ?? "") + (r.stderr ?? ""));
High
Shell
Package source references shell execution.
skills/video-studio/scripts/qa.mjsView on unpkg · L628skills/coder-brainstorming/scripts/server.cjsView file
Findings
8 High4 Medium7 Low
HighChild Processbin/sync-plugin-repo.js
HighShellskills/video-studio/scripts/qa.mjs
HighSame File Env Network Executionbin/install.js
HighExternal Ai Agent Control Surface Mutationhooks/update-notice.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighSemantic Analysis Limitedskills/coder-brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similarityskills/coder-writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/research/scripts/doctor.sh
Affected versions and remediation
This report applies to luckiest-co@1.0.43.
See all versions of luckiest-co for other recorded verdicts.
- Review the evidence and your use of luckiest-co@1.0.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.