registry / luckiest-co / 1.0.45
luckiest-co@1.0.45
Luckiest for Claude Code: plan, go, finish. Your luckiest.co skills and tribe, inside Claude.
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found no malicious behavior. The flagged installer configuration is consent-gated, and the inspected network behavior supports package functionality or Luckiest skill-usage telemetry.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the CLI, a skill utility, or a configured skill usage hook.
Impact
No confirmed unauthorized credential transfer, destructive action, persistence, or foreign agent configuration mutation was found.
Mechanism
The installer copies skills and can register a usage hook after consent. The hook reports Luckiest skill metadata to the Luckiest API; other flagged utilities perform their named local or service tasks.
AI rationale
Source inspection found no malicious behavior. The flagged installer configuration is consent-gated, and the inspected network behavior supports package functionality or Luckiest skill-usage telemetry.
Evidence
package.jsonbin/install.jsbin/sync-plugin-repo.jsskills/video-studio/scripts/qa.mjshooks/update-notice.mjsskills/coder-brainstorming/scripts/server.cjsskills/coder-writing-skills/render-graphs.jsskills/trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.jshooks/report-skill-usage.mjs
Network endpoints4
api.luckiest.coraw.githubusercontent.comx.comgithub.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes an explicit CLI and only a prepublishOnly script; it has no install lifecycle hook.
- The flagged installer location cleans up duplicate skills; registering usage tracking requires an affirmative prompt or --hook, and an unanswered prompt declines.
- The flagged utilities serve user-requested plugin sync, video QA, local brainstorming, diagram rendering, and X query-ID caching.
- The update notice checks a public Luckiest plugin manifest and displays an update message; usage telemetry is sent to the Luckiest API and is limited to Luckiest skill runs.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
10 flaggedbin/sync-plugin-repo.jsView file
6L7: const { execFileSync } = require('child_process');
L8: const fs = require('fs');
High
Child Process
Package source references child process execution.
bin/sync-plugin-repo.jsView on unpkg · L6skills/video-studio/scripts/qa.mjsView file
628passes = prompts.map((p, i) => {
L629: const r = spawnSync(opt("--cmd"), { shell: true, input: p, encoding: "utf8", maxBuffer: 1 << 26 });
L630: writeFileSync(join(out, `pass${i + 1}.txt`), (r.stdout ?? "") + (r.stderr ?? ""));
High
Shell
Package source references shell execution.
skills/video-studio/scripts/qa.mjsView on unpkg · L628skills/coder-brainstorming/scripts/server.cjsView file
Findings
8 High4 Medium7 Low
HighChild Processbin/sync-plugin-repo.js
HighShellskills/video-studio/scripts/qa.mjs
HighSame File Env Network Executionbin/install.js
HighExternal Ai Agent Control Surface Mutationhooks/update-notice.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighSemantic Analysis Limitedskills/coder-brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similarityskills/coder-writing-skills/render-graphs.js
HighKnown Malware Source Similarityskills/trends/scripts/lib/vendor/bird-search/lib/runtime-query-ids.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/research/scripts/doctor.sh
Affected versions and remediation
This report applies to luckiest-co@1.0.45.
See all versions of luckiest-co for other recorded verdicts.
- Review the evidence and your use of luckiest-co@1.0.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.