by beidald
Lilium AI: The ultimate personal AI agent framework for autonomous computer control. Featuring browser automation, shell execution, and multi-channel integration (WeChat/Telegram/Discord).
# Add to your Claude Code skills
git clone https://github.com/beidald/liliumaiLast scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@jimp/core: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@jimp/custom: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@larksuiteoapi/node-sdk: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@xenova/transformers: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "cheerio: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "css-select: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-xml-parser: fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "file-box: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "file-type: file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "form-data: form-data uses unsafe random function in form-data for choosing boundary",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "imap: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "imap-simple: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "jimp: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "lodash.pick: Prototype Pollution in lodash",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nth-check: Inefficient Regular Expression Complexity in nth-check",
"severity": "high"
},
{
"type": "npm-audit",
"message": "onnx-proto: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "onnxruntime-web: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "open-graph: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "phin: phin may include sensitive headers in subsequent requests after redirect",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "pkg: Pkg Local Privilege Escalation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "puppeteer: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "request: Server-Side Request Forgery in Request",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "semver: semver vulnerable to Regular Expression Denial of Service",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tough-cookie: tough-cookie Prototype Pollution vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "utf7: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wechaty: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wechaty-puppet: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wechaty-puppet-service: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wechaty-puppet-wechat: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "wechaty-puppet-wechat4u: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wechaty-redux: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wechaty-token: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws affected by a DoS when handling a request with many HTTP headers",
"severity": "high"
},
{
"type": "npm-audit",
"message": "xml2js: xml2js is vulnerable to prototype pollution",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T16:36:44.857Z",
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Not just a chatbot, but your AI Co-pilot for total computer automation. liliumai.cn
Lilium AI is a powerful personal AI agent framework designed for autonomous execution. It connects Large Language Models (LLMs) like OpenAI and Ollama to browser automation, system-level shell control, deep file integration, and omni-channel communication, enabling AI to perform complex end-to-end tasks just like a human.
plugins/ folder.plugins/ folder.npm install -g pnpm)check-permissions).Clone the repository
git clone https://github.com/beidald/liliumai.git
cd liliumai
Install dependencies
pnpm install
Configure the project Copy the example configuration file to create your local config.
cp config.example.json config.json
Edit config.json
Open config.json and fill in your details:
wechat, telegram) and add tokens.admin section.Security Note: Never commit your
config.jsonto version control. The project is configured to ignore it by default.
Check Permissions (macOS only) If running on macOS and using Wechaty/Puppeteer, you may need to grant accessibility permissions.
pnpm check-permissions
Start the agent in development mode:
pnpm start
Or build and run for production:
pnpm build
node dist/index.js
The config.json file is the heart of Lilium AI. Here are key sections:
Secure your Web Interface and API endpoints.
"admin": {
"email": "admin@example.com",
"password": "YOUR_STRONG_PASSWORD"
}
Configure multiple providers with priorities.
"llm": [
{
"provider": "openai",
"model": "gpt-4",
"apiKey": "sk-...",
"priority": 1
},
{
"provider": "ollama",
"model": "llama3",
"baseUrl": "http://localhost:11434/v1",
"priority": 2
}
]
Enable automatic voice-to-text for audio messages.
"transcription": {
"provider": "local", // "local" or "groq"
"model": "base", // "tiny", "base", "small", "medium", "large"
"apiKey": "" // Required for cloud providers
}
Note: Local models will be automatically downloaded on first use from HuggingFace (with domestic mirror support).
Enable channels as needed. For example, to enable the Web UI:
"channels": {
"web": {
"enabled": true,
"port": 3000
}
}
Once running, access the Web UI at:
http://localhost:3000

config.json.Lilium AI's true power lies in skill composition. You can give complex natural language instructions:
Lilium AI is an open project, and we welcome developers to join us in building the most powerful personal AI agent!
plugins/ directory without touching the core code (Check PLUGINS.md).Check out our CONTRIBUTING.md for more details. Let's define the future of AI automation together!
Email: beidaliudong@pku.org.cn
MIT License.