@easbot/skills@0.3.26
Skills management system for EAS Agent ecosystem (add / remove / list / find / update / sync / use)
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package sends runtime telemetry containing skill and source details by default, beyond the ordinary anonymous telemetry fields permitted by the review rules. This is suspicious telemetry; the flagged agent launch is explicit and does not upload command output.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI operation that records an event, such as installing skills; telemetry is sent unless disabled by environment variable.
Impact
The vendor receives details about the user's skill sources, selected skills, agents, and skill files. No credential or file-content collection was identified.
Mechanism
Event fields are encoded as URL query parameters and sent to https://add-skill.vercel.sh/t.
AI rationale
The package sends runtime telemetry containing skill and source details by default, beyond the ordinary anonymous telemetry fields permitted by the review rules. This is suspicious telemetry; the flagged agent launch is explicit and does not upload command output.
Evidence
dist/chunks/chunk-Q2MOP5ZW.cjsdist/chunks/chunk-WGGVLBPO.cjs
Network endpoints1
add-skill.vercel.sh/t
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The install event sends the source, skill names, target agents, global-install flag, and serialized skill-file details.
- Telemetry is enabled by default and sends event fields to https://add-skill.vercel.sh/t; DISABLE_TELEMETRY or DO_NOT_TRACK disables it.
- The flagged agent launch passes generated skill text to the explicitly selected agent and inherits terminal I/O.
Evidence against
- package.json declares no install, preinstall, or postinstall lifecycle hook.
- The inspected telemetry fields contain workflow and skill metadata, not credentials or file contents.
- The agent process launch occurs on the explicit use command with agent selection.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/chunks/chunk-HOK3SUH4.cjsView file
1'use strict';var chunkJUNIAQ2A_cjs=require('./chunk-JUNIAQ2A.cjs'),chunkXGUPIAAF_cjs=require('./chunk-XGUPIAAF.cjs'),chunkDNE3XPCJ_cjs=require('./chunk-DNE3XPCJ.cjs'),chunkE7AHWFZN...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
High
Child Process
Package source references child process execution.
dist/chunks/chunk-HOK3SUH4.cjsView on unpkg · L1dist/chunks/chunk-HOK3SUH4.cjs#virtual:string-array:round1View file
1"use strict";var chunkJUNIAQ2A_cjs=require("./chunk-JUNIAQ2A.cjs"),chunkXGUPIAAF_cjs=require("./chunk-XGUPIAAF.cjs"),chunkDNE3XPCJ_cjs=require("./chunk-DNE3XPCJ.cjs"),chunkE7AHWFZN...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
...
L8: Enable it with: git config --global protocol.allowUnsafeFilter true
L9: Or upgrade Git, or unset filter.<driver>.* in the source repo.`:"";throw new L(`Failed to clone ${n}: ${l}${u}`,n,false,false)}}async function In(n){let t=path.normalize(path.resol...
L10: source skill path=${c.path} (parsed.type=${n.type})
High
Same File Env Network Execution
Findings
1 Critical6 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/chunks/chunk-WGGVLBPO.cjs
HighChild Processdist/chunks/chunk-HOK3SUH4.cjs
HighShell
HighSame File Env Network Executiondist/chunks/chunk-HOK3SUH4.cjs#virtual:string-array:round1
HighCommand Output Exfiltrationdist/chunks/chunk-WGGVLBPO.cjs
HighTrigger Reachable Command Output Exfiltrationdist/chunks/chunk-WGGVLBPO.cjs
HighSemantic Analysis Limiteddist/chunks/chunk-HOK3SUH4.cjs#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @easbot/skills@0.3.26.
See all versions of @easbot/skills for other recorded verdicts.
- Review the evidence and your use of @easbot/skills@0.3.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.