registry / @easbot/skills / 0.3.14
@easbot/skills@0.3.14
⚠ Under reviewSkills management system for EAS Agent ecosystem (add / remove / list / find / update / sync / use)
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/chunks/chunk-6NTEYECA.mjsView file
1import {k}from'./chunk-ML6B4IQL.mjs';import {p,m as m$1,o}from'./chunk-RWZ4LFSN.mjs';import {b as b$1,c,d as d$1,l}from'./chunk-ZJS7IO5V.mjs';import {a,d,b as b$2}from'./chunk-ZYDD...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
High
Child Process
Package source references child process execution.
dist/chunks/chunk-6NTEYECA.mjsView on unpkg · L1dist/chunks/chunk-6NTEYECA.mjs#virtual:string-array:round1View file
1import {k}from"./chunk-ML6B4IQL.mjs";import {p,m as m$1,o}from"./chunk-RWZ4LFSN.mjs";import {b as b$1,c,d as d$1,l}from"./chunk-ZJS7IO5V.mjs";import {a,d,b as b$2}from"./chunk-ZYDD...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
...
L8: Enable it with: git config --global protocol.allowUnsafeFilter true
L9: Or upgrade Git, or unset filter.<driver>.* in the source repo.`:"";throw new L(`Failed to clone ${n}: ${l}${u}`,n,false,false)}}async function $n(n){let t=normalize(resolve(n)),e=n...
L10: source skill path=${c.path} (parsed.type=${n.type})
High
Same File Env Network Execution
Findings
1 Critical5 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/chunks/chunk-2E6BHPFV.cjs
HighChild Processdist/chunks/chunk-6NTEYECA.mjs
HighShell
HighSame File Env Network Executiondist/chunks/chunk-6NTEYECA.mjs#virtual:string-array:round1
HighCommand Output Exfiltrationdist/chunks/chunk-2E6BHPFV.cjs
HighTrigger Reachable Command Output Exfiltrationdist/chunks/chunk-2E6BHPFV.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @easbot/skills@0.3.14.
See all versions of @easbot/skills for other recorded verdicts.
- Review the evidence and your use of @easbot/skills@0.3.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.