@easbot/skills@0.3.27
Skills management system for EAS Agent ecosystem (add / remove / list / find / update / sync / use)
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package performs disclosed runtime telemetry, but install events include skill source and file inventory details beyond basic anonymous usage metrics. This warrants a warning for excess telemetry, not a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a CLI command tracks an event; the CLI flushes queued telemetry on exit.
Impact
The endpoint can receive information about the user's skill sources and installed skill inventory.
Mechanism
The package sends event fields to add-skill.vercel.sh, including skill sources, names, target agents, and file mappings. DISABLE_TELEMETRY or DO_NOT_TRACK disables tracking.
AI rationale
The package performs disclosed runtime telemetry, but install events include skill source and file inventory details beyond basic anonymous usage metrics. This warrants a warning for excess telemetry, not a publish block.
Evidence
dist/chunks/chunk-CFMOYU7R.mjsdist/chunks/chunk-OAWQHVZV.cjsdist/cli.mjsREADME.en.md
Network endpoints1
add-skill.vercel.sh/t
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Skill-install telemetry includes the source identifier, skill names, target agents, and a mapping of skill files.
- Telemetry sends tracking fields to https://add-skill.vercel.sh/t; it can be disabled with DISABLE_TELEMETRY or DO_NOT_TRACK.
- The CLI flushes queued telemetry after command completion.
- The README discloses telemetry and audit reporting to skills.sh but does not describe the install-event fields.
- Agent processes are launched with inherited terminal I/O, rather than capturing their output for transmission.
Evidence against
- The manifest describes a skills management package, consistent with the install and agent-launch features.
- The package has no install lifecycle hook in its manifest.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/chunks/chunk-HOK3SUH4.cjsView file
1'use strict';var chunkJUNIAQ2A_cjs=require('./chunk-JUNIAQ2A.cjs'),chunkXGUPIAAF_cjs=require('./chunk-XGUPIAAF.cjs'),chunkDNE3XPCJ_cjs=require('./chunk-DNE3XPCJ.cjs'),chunkE7AHWFZN...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
High
Child Process
Package source references child process execution.
dist/chunks/chunk-HOK3SUH4.cjsView on unpkg · L1dist/chunks/chunk-HOK3SUH4.cjs#virtual:string-array:round1View file
1"use strict";var chunkJUNIAQ2A_cjs=require("./chunk-JUNIAQ2A.cjs"),chunkXGUPIAAF_cjs=require("./chunk-XGUPIAAF.cjs"),chunkDNE3XPCJ_cjs=require("./chunk-DNE3XPCJ.cjs"),chunkE7AHWFZN...
L2: skills tried your existing git credentials and available fallbacks, but none succeeded.
...
L8: Enable it with: git config --global protocol.allowUnsafeFilter true
L9: Or upgrade Git, or unset filter.<driver>.* in the source repo.`:"";throw new L(`Failed to clone ${n}: ${l}${u}`,n,false,false)}}async function In(n){let t=path.normalize(path.resol...
L10: source skill path=${c.path} (parsed.type=${n.type})
High
Same File Env Network Execution
Findings
1 Critical6 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/chunks/chunk-OAWQHVZV.cjs
HighChild Processdist/chunks/chunk-HOK3SUH4.cjs
HighShell
HighSame File Env Network Executiondist/chunks/chunk-HOK3SUH4.cjs#virtual:string-array:round1
HighCommand Output Exfiltrationdist/chunks/chunk-OAWQHVZV.cjs
HighTrigger Reachable Command Output Exfiltrationdist/chunks/chunk-OAWQHVZV.cjs
HighSemantic Analysis Limiteddist/chunks/chunk-HOK3SUH4.cjs#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @easbot/skills@0.3.27.
See all versions of @easbot/skills for other recorded verdicts.
- Review the evidence and your use of @easbot/skills@0.3.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.