registry / @jive-sh/skill-sync / 0.4.15
@jive-sh/skill-sync@0.4.15
Keeps one skills directory identical across every machine you work on.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe postinstall hook configures a persistent daemon, but the package documents that behavior as necessary for syncing and updating. The inspected source sends skill data and disclosed usage readings to its configured service; no unrelated credential collection or other attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall; the daemon then starts at login. CI installs and repair-only runs skip registration.
Impact
Persistent background syncing and updates are expected behavior for this package’s stated purpose; no unrelated collection or account action was identified.
Mechanism
The installer registers the daemon with the OS service manager. After a user signs in, it syncs selected skills and sends disclosed account-usage readings to the configured service.
AI rationale
The postinstall hook configures a persistent daemon, but the package documents that behavior as necessary for syncing and updating. The inspected source sends skill data and disclosed usage readings to its configured service; no unrelated credential collection or other attack behavior was found.
Evidence
~/.jive/daemons/<id>.json~/.jive/logs/<id>.log~/Library/LaunchAgents/<id>.plist${XDG_CONFIG_HOME:-~/.config}/systemd/user/<id>.service
Network endpoints1
skill-sync.jive.sh
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook installs command targets and registers the package’s daemon; the README discloses that it starts at login.
- The daemon syncs skills to the documented skill-sync service, and network requests use the configured endpoint with the service token.
- File uploads are limited to skill files selected for sync; account usage is described as readings from Claude and Codex usage files.
Evidence against
- Installation creates a login-starting daemon and the README says it automatically checks for updates every five minutes.
- The platform-specific executable packages were unavailable for direct source inspection.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node ./install.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./install.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall.cjsView file
3Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L3: // CommonJS, not an ES module: a launcher is an extensionless file, and Node 14 and 16 refuse to load an
L4: // extensionless ES module in a "type": "module" package (ERR_UNKNOWN_FILE_EXTENSION; Node 18.20 accepts it). bin/package.json marks this directory
L5: // "commonjs", and the install script is install.cjs, so both load the same way on every Node and on Bun.
L6: const { spawnSync } = require("child_process");
L7: const {
...
L81: const packageJsonPath = require.resolve(`${PLATFORM_PACKAGES[platformKey]}/package.json`);
L82: const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
L83: return {
...
L97: * package manager: on an
Findings
5 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergenceinstall.cjs
HighTrigger Reachable Persistenceinstall.cjs
HighSemantic Analysis Limitedbin/skill-sync#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/entrypoints/skill-sync.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceinstall.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @jive-sh/skill-sync@0.4.15.
See all versions of @jive-sh/skill-sync for other recorded verdicts.
- Review the evidence and your use of @jive-sh/skill-sync@0.4.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.