registry / @easbot/skills / 0.3.4
@easbot/skills@0.3.4
⚠ Under reviewSkills management system for EAS Agent ecosystem (add / remove / list / find / update / sync / use)
Static Scan Results
scanned 36m ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.cjsView file
1'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=requ...
L2: `;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await ul(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256")...
High
1'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=requ...
L2: `;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await ul(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256")...
...
L5: ---
L6: ${s.replace(/^\r?\n/u,"")}`}async function ms(t,e,s){await promises.mkdir(e,{recursive:true});let n=await promises.readdir(t,{withFileTypes:true});await Promise.all(n.filter(l=>!No...
L7: `)+`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.cjsView on unpkg · L11'use strict';var chunkEOOPF3RI_cjs=require('./chunks/chunk-EOOPF3RI.cjs'),fs$1=require('fs'),path=require('path'),xdgBasedir=require('xdg-basedir'),os$1=require('os'),promises=requ...
L2: `;await promises.writeFile(s,o,"utf-8");}async function Fe(t){let e=[];await ul(t,t,e),e.sort((n,l)=>n.relativePath.localeCompare(l.relativePath));let s=crypto.createHash("sha256")...
...
L5: ---
L6: ${s.replace(/^\r?\n/u,"")}`}async function ms(t,e,s){await promises.mkdir(e,{recursive:true});let n=await promises.readdir(t,{withFileTypes:true});await Promise.all(n.filter(l=>!No...
L7: `)+`
Findings
6 High2 Medium4 Low
HighChild Processdist/index.cjs
HighShell
HighSame File Env Network Executiondist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @easbot/skills@0.3.4.
See all versions of @easbot/skills for other recorded verdicts.
- Review the evidence and your use of @easbot/skills@0.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.