registry / @glitches/skills / 1.5.15

@glitches/skills@1.5.15

The open agent skills ecosystem

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 4 file(s), 633 KB of source, external domains: add-skill.vercel.sh, api.github.com, connectors-skills.zapier.com, example.com, github.com, gitlab.com, raw.githubusercontent.com, schemas.agentskills.io, skills.sh

Source & flagged code

2 flagged

dist/_chunks/libs/common.mjsView file

Lines 1-29javascript

1import { n as __require, r as __toESM, t as __commonJSMin } from "../rolldown-runtime.mjs";

2import path from "path";

3import { stripVTControlCharacters } from "node:util";

4import y, { stdin, stdout } from "node:process";

5import * as g from "node:readline";

6import O from "node:readline";

7import { Writable } from "node:stream";

8import os from "os";

9import { Buffer as Buffer$1 } from "node:buffer";

10import { spawn } from "child_process";

11import { normalize as normalize$1 } from "node:path";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/common.mjsView on unpkg · L9

12import { EventEmitter } from "node:events";

13var require_src$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {

14 const ESC = "\x1B";

15 const CSI = `${ESC}[`;

16 const beep = "\x07";

17 const cursor = {

18 to(x, y) {

19 if (!y) return `${CSI}${x + 1}G`;

20 return `${CSI}${y + 1};${x + 1}H`;

21 },

22 move(x, y) {

23 let ret = "";

24 if (x < 0) ret += `${CSI}${-x}D`;

25 else if (x > 0) ret += `${CSI}${x}C`;

26 if (y < 0) ret += `${CSI}${-y}A`;

27 else if (y > 0) ret += `${CSI}${y}B`;

28 return ret;

29 },

dist/cli.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { r as __toESM } from "./_chunks/rolldown-runtime.mjs";

3import { a as Ie, c as Se, d as fe, f as ve, g as require_picocolors, h as pD, i as esm_default, l as Y, m as ye, n as xdgConfig, o as M, p as xe, r as

Source & flagged code

2 flagged · loading source

dist/_chunks/libs/common.mjsView file

9import { Buffer as Buffer$1 } from "node:buffer"; L10: import { spawn } from "child_process"; L11: import { normalize as normalize$1 } from "node:path";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/common.mjsView on unpkg · L9

dist/cli.mjsView file

12Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/common.mjs; helper contains network access plus dynamic code execution. L12: import { promisify } from "util"; L13: import { execFile, execSync, spawn, spawnSync } from "child_process"; L14: import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises"; L15: import { createHash as createHash$1 } from "crypto"; L16: import { gunzipSync, inflateRawSync } from "node:zlib"; L17: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1); ... L34: } L35: if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null; L36: try { ... L50: } L51: async function isRepoPrivate(owner, repo) { L52: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L12

Findings

3 High4 Medium5 Low

HighChild Processdist/_chunks/libs/common.mjs

HighShell

HighCross File Remote Execution Contextdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/_chunks/libs/common.mjsView file

Lines 1-29javascript

1import { n as __require, r as __toESM, t as __commonJSMin } from "../rolldown-runtime.mjs";

2import path from "path";

3import { stripVTControlCharacters } from "node:util";

4import y, { stdin, stdout } from "node:process";

5import * as g from "node:readline";

6import O from "node:readline";

7import { Writable } from "node:stream";

8import os from "os";

9import { Buffer as Buffer$1 } from "node:buffer";

10import { spawn } from "child_process";

11import { normalize as normalize$1 } from "node:path";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/common.mjsView on unpkg · L9

12import { EventEmitter } from "node:events";

13var require_src$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {

14 const ESC = "\x1B";

15 const CSI = `${ESC}[`;

16 const beep = "\x07";

17 const cursor = {

18 to(x, y) {

19 if (!y) return `${CSI}${x + 1}G`;

20 return `${CSI}${y + 1};${x + 1}H`;

21 },

22 move(x, y) {

23 let ret = "";

24 if (x < 0) ret += `${CSI}${-x}D`;

25 else if (x > 0) ret += `${CSI}${x}C`;

26 if (y < 0) ret += `${CSI}${-y}A`;

27 else if (y > 0) ret += `${CSI}${y}B`;

28 return ret;

29 },

dist/cli.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { r as __toESM } from "./_chunks/rolldown-runtime.mjs";

3import { a as Ie, c as Se, d as fe, f as ve, g as require_picocolors, h as pD, i as esm_default, l as Y, m as ye, n as xdgConfig, o as M, p as xe, r as