Automic Vault

brew package intelligence

luarocks

Automic Vault tracks luarocks because plain text luarocks upload key matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about luarocks

Package manager for the Lua programming language

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text LuaRocks Upload Key

LuaRocks upload can persist an API key in upload_config.lua in the user's LuaRocks config directory. Our isotope stores that API key in the macOS keychain and injects it only for `luarocks upload` commands.

Local README excerpt

LuaRocks Radioisotope

luarocks upload --api-key=... persists the upload API key in upload_config.lua next to the user's LuaRocks config. The radioisotope moves that key into the macOS keychain and injects it as LUAROCKS_API_KEY only when luarocks upload runs without an explicit --api-key.

The migration checks the default XDG and legacy LuaRocks user config locations, plus any LUAROCKS_CONFIG-style override in the current environment, and rewrites key = "..." assignments to key = nil.

Caveats

  • Only Lua string assignments to an upload config key field are migrated.
  • If multiple distinct upload keys are found, migration stops so the user can

choose the correct key manually.

  • Upload keys passed later with --api-key are still handled by LuaRocks

itself and may be written by LuaRocks.

  • Direct execution of the original binary will not receive credentials.

Source: data/radioisotopes/luarocks/README.md

Caveats

  • Only Lua string assignments to an upload config key field are migrated.
  • Multiple distinct upload keys require manual migration.
  • Direct execution of the original binary will not receive credentials.

install metadata

Resolver facts

Package keybrew:luarocks
Last updated2026-03-20T18:54:26Z
Pulseupdated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • Nucleus package database
  • local isotope README
  • radioisotope security manifest