registry / @easbot/skills / 0.2.48

@easbot/skills@0.2.48

Skills management system for EAS Agent ecosystem (add / remove / list / find / update / sync / use)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 323 KB of source, external domains: add-skill.vercel.sh, api.github.com, connectors-skills.zapier.com, example.com, github.com, gitlab.com, raw.githubusercontent.com, schemas.agentskills.io, skills.sh

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 1-21javascript

1'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=require('fs/promises'),crypto=require('crypto'),y=require('@clack/prompts'),k=require('picocolors'),ws=require('readline'),util=require('util'),stream=require('stream'),er=require('simple-git'),child_process=require('child_process'),detectAgent=require('@vercel/detect-agent'),zlib=require('zlib'),url=require('url');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespace(e){if(e&&e.__es ...

2`;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await cl(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256");for(let n of e)s.update(n.relativePath),s.update(n.content);return s.digest("hex")}async function cl(t,e,s){let n=await promises.readdir(e,{withFileTypes:true});await Promise.all(n.map(async l=>{let o=path.join(e,l.name);if(l.isDirectory()){if(l.name===".git"||l.name==="node_modules")return;await cl(t,o,s);}else if(l.isFile()){let i=await promises.readFile(o),a=path.relative(t,o).split("\\").join("/");s.push({relati ...

High

Child Process

Package source references child process execution.

dist/index.cjsView on unpkg · L1

3${l.map(i=>`${i}: ${JSON.stringify(n[i])}`).join(`

4`)}

5---

6${s.replace(/^\r?\n/u,"")}`}async function ms(t,e,s){await promises.mkdir(e,{recursive:true});let n=await promises.readdir(t,{withFileTypes:true});await Promise.all(n.filter(l

7`)+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

8`),d=Qo(L,process.stdout.columns);},$=()=>{process.stdin.removeListener("keypress",F),process.stdin.isTTY&&process.stdin.setRawMode(false),r.close();},E=()=>{o&&g.size===0&&m.length===0||(A("submit"),$(),a([...

9 skills tried your existing git credentials and available fallbacks, but none succeeded.

10 - Re-authorize your GitHub credentials/app for that org's SSO policy

11 - Or rerun with SSH: easbot skills add ${e.sshUrl}

12 - Verify access with: gh auth status -h github.com or ssh -T git@github.com`:e?`Authentication failed for ${t}.

13 - For private repos, ensure you have access

14 - Retry with SSH: easbot skills add ${e.sshUrl}

15 - Check access with: gh auth status -h github.com or ssh -T git@github.com`:`Authentication failed for ${t}.

16 - For private repos, ensure you have access

17 - For SSH: Check your keys with 'ssh -T git@github.com'

18 - For HTTPS: Run 'gh auth login' or configure git credentials`}async function We(t,e){let s=await promises.mkdtemp(path.join(os$1.tmpdir(),"skills-")),n=e?["--depth","1","--branch",e]:["--depth","1"],l=Dl(t);try{return await Ll().clone(t,s,n),s}catch(o){let i=o instanceof Error?o.message:String(o),a=i.includes("block timeout")||i.includes("timed out"),r=rr(i);if(a){try{await promises.rm(s,{recursive:!0,force:!0});}catch{}let h=Math.round(nn/1e3);throw new Me(`Clone timed out after ${h}s. Common causes:

19 - Large repository: raise the timeout with SKILLS_CLONE_TIMEOUT_MS=600000 (10m)

20 - Slow network: retry, or clone manually and pass the local path to 'skills add'

21 - Private repo without credentials: ensure auth is configured

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

1'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=requ... L2: `;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await cl(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256")...

High

Child Process

Package source references child process execution.

dist/index.cjsView on unpkg · L1

1'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=requ... L2: `;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await cl(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256")... ... L5: --- L6: ${s.replace(/^\r?\n/u,"")}`}async function ms(t,e,s){await promises.mkdir(e,{recursive:true});let n=await promises.readdir(t,{withFileTypes:true});await Promise.all(n.filter(l=>!To... L7: `)+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

1'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=requ... L2: `;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await cl(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256")... ... L5: --- L6: ${s.replace(/^\r?\n/u,"")}`}async function ms(t,e,s){await promises.mkdir(e,{recursive:true});let n=await promises.readdir(t,{withFileTypes:true});await Promise.all(n.filter(l=>!To... L7: `)+`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

Findings

4 High2 Medium4 Low

HighChild Processdist/index.cjs

HighShell

HighSame File Env Network Executiondist/index.cjs

HighCommand Output Exfiltrationdist/index.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 1-21javascript

High

Child Process

Package source references child process execution.

dist/index.cjsView on unpkg · L1

3${l.map(i=>`${i}: ${JSON.stringify(n[i])}`).join(`

4`)}

5---

6${s.replace(/^\r?\n/u,"")}`}async function ms(t,e,s){await promises.mkdir(e,{recursive:true});let n=await promises.readdir(t,{withFileTypes:true});await Promise.all(n.filter(l

7`)+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.cjsView on unpkg · L1

9 skills tried your existing git credentials and available fallbacks, but none succeeded.

10 - Re-authorize your GitHub credentials/app for that org's SSO policy

11 - Or rerun with SSH: easbot skills add ${e.sshUrl}

12 - Verify access with: gh auth status -h github.com or ssh -T git@github.com`:e?`Authentication failed for ${t}.

13 - For private repos, ensure you have access

14 - Retry with SSH: easbot skills add ${e.sshUrl}

15 - Check access with: gh auth status -h github.com or ssh -T git@github.com`:`Authentication failed for ${t}.

16 - For private repos, ensure you have access

17 - For SSH: Check your keys with 'ssh -T git@github.com'

19 - Large repository: raise the timeout with SKILLS_CLONE_TIMEOUT_MS=600000 (10m)

20 - Slow network: retry, or clone manually and pass the local path to 'skills add'

21 - Private repo without credentials: ensure auth is configured

Long lines were clipped for display.