registry / luzra-cli
luzra-cli
터미널 AI(Claude Code) 프롬프트 습관을 채점·코칭하는 리포트 — 세션 로그는 로컬에서만 분석됩니다.
This report shows the evidence for luzra-cli@0.3.0. 0 of 9 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source supports the package's stated purpose: analyzing Claude Code sessions and optionally syncing results to a dashboard. Scheduler setup is called from init, and network use is tied to the configured dashboard or npm's registry; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; dashboard connection and daily scheduling occur through the init workflow.
Impact
Expected CLI behavior; no source evidence of secret theft, unrelated collection, or hidden persistence.
Mechanism
It analyzes local session data, optionally syncs report data to the configured dashboard, and checks the npm registry for updates during report runs.
AI rationale
The source supports the package's stated purpose: analyzing Claude Code sessions and optionally syncing results to a dashboard. Scheduler setup is called from init, and network use is tied to the configured dashboard or npm's registry; no malicious behavior was identified.
Evidence
~/.luzra configuration and report dataOS scheduler configuration and ~/.luzra/logs
Network endpoints2
luzra.aimgonna.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no lifecycle scripts; it describes local analysis of Claude Code session logs.
- Dashboard connection is offered during init and requires confirmation before connecting.
- Daily scheduling is installed by the init flow, and the scheduled task runs the package's report command.
- Profile sync uses the configured dashboard URL and token; its source says prompt text stays local.
- Self-updates are checked against the official npm registry during report runs.
Evidence against
- The package creates a persistent daily task and can update its global installation at runtime, but the source ties these actions to user-run CLI workflows.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggedsrc/connect.jsView file
1// 디바이스 코드 페어링 — 토큰을 사람이 복사·전달할 필요가 없다.
L2: import { spawn } from "node:child_process";
L3: import { c, blank, info, ok, warn } from "./ui.js";
High
1// 디바이스 코드 페어링 — 토큰을 사람이 복사·전달할 필요가 없다.
L2: import { spawn } from "node:child_process";
L3: import { c, blank, info, ok, warn } from "./ui.js";
L4:
L5: export const DEFAULT_URL = "https://luzra.aimgonna.com";
L6:
...
L8: const cmd =
L9: process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
L10: : process.platform === "darwin" ? ["open", [url]]
...
L23: headers: { "Content-Type": "application/json" },
L24: body: JSON.stringify(body || {}),
L25: });
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/connect.jsView on unpkg · L1src/install.jsView file
17// Windows의 npm은 npm.cmd라 shell이 필요하다. 인자를 배열로 주면 경고가 나므로 문자열로 넘긴다.
L18: const r = spawnSync("npm root -g", { encoding: "utf-8", shell: true });
L19: const dir = (r.stdout || "").trim();
Findings
1 Critical6 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/schedule.js
HighChild Processsrc/connect.js
HighShellsrc/install.js
HighSandbox Evasion Gated Capabilitysrc/connect.js
HighTrigger Reachable Persistencesrc/schedule.js
HighRuntime Package Installsrc/install.js
HighSemantic Analysis Limitedsrc/engine.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/schedule.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to luzra-cli@0.3.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of luzra-cli@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.