registry / @easbot/skills / 0.3.13
@easbot/skills@0.3.13
Skills management system for EAS Agent ecosystem (add / remove / list / find / update / sync / use)
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/chunks/chunk-SXUY2J75.cjsView file
1'use strict';var chunkCXH3OTTQ_cjs=require('./chunk-CXH3OTTQ.cjs'),chunkXGUPIAAF_cjs=require('./chunk-XGUPIAAF.cjs'),promises=require('fs/promises'),path=require('path'),crypto=req...
L2: ${n__default.default.yellow("\u2502")} ${n__default.default.dim(`Tip: set ${n__default.default.cyan("GITHUB_TOKEN")} to avoid this prompt, or use ${n__default.default.cyan("--full...
High
Child Process
Package source references child process execution.
dist/chunks/chunk-SXUY2J75.cjsView on unpkg · L1dist/chunks/chunk-CXH3OTTQ.cjs#virtual:string-array:round1View file
1"use strict";var chunkISMGLHYS_cjs=require("./chunk-ISMGLHYS.cjs"),chunkXGUPIAAF_cjs=require("./chunk-XGUPIAAF.cjs"),chunkRVR3DSD2_cjs=require("./chunk-RVR3DSD2.cjs"),chunkE7AHWFZN...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
...
L8: Enable it with: git config --global protocol.allowUnsafeFilter true
L9: Or upgrade Git, or unset filter.<driver>.* in the source repo.`:"";throw new L(`Failed to clone ${n}: ${l}${u}`,n,false,false)}}async function vn(n){let t=path.normalize(path.resol...
L10: source skill path=${c.path} (parsed.type=${n.type})
Findings
5 High2 Medium4 Low
HighChild Processdist/chunks/chunk-SXUY2J75.cjs
HighShell
HighSame File Env Network Executiondist/chunks/chunk-CXH3OTTQ.cjs#virtual:string-array:round1
HighCommand Output Exfiltrationdist/chunks/chunk-K2XGYOXP.mjs
HighTrigger Reachable Command Output Exfiltrationdist/chunks/chunk-UJWB7QQ6.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @easbot/skills@0.3.13.
See all versions of @easbot/skills for other recorded verdicts.
- Review the evidence and your use of @easbot/skills@0.3.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.