registry / @kyh/skills / 0.2.1

@kyh/skills@0.2.1

Personal Claude Code + Codex skills, MCP servers, and global instructions. `npx @kyh/skills install` copies them into a canonical ~/.agents store (and ~/.claude).

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source inspection found no npm lifecycle hook; the installer is exposed as a CLI and runs when the user selects its install command. Its global agent configuration and skill installation behavior aligns with the package's stated purpose, with no concrete attack established.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the package's install command.

Impact

The command changes global agent configuration and installs agent functionality; inspected source does not establish malicious behavior.

Mechanism

The command copies package skills, may fetch listed external skills, and adds missing MCP settings to the user's Claude configuration.

AI rationale

Evidence

~/.agents~/.claude~/.claude.json

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes an installer command and lists no npm install lifecycle hook; its scripts are named local setup and external checking tasks.
The installer runs only when the CLI receives the explicit install command, and its setup phases are invoked from that command.
The installer writes to the user's agent directories and adds configured MCP servers only when they are not already present.
The configured Motion server uses a Motion token supplied through an environment variable.

Evidence against

Running the explicit install command can fetch listed external skills and add a global MCP server, but these actions match the package's stated setup function.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 21.0 KB of source

Source & flagged code

6 flagged

scripts/install.mjsView file

Lines 1-42javascript

1// `kyh-skills install`: puts this package into the agent ecosystem, the same

2// way `npx skills` does:

3//

4// 1. Canonical store at ~/.agents — skills/<name> are copied here from the

5// package. "Universal" agents (codex, amp, opencode, goose, kimi) read

6// ~/.agents directly, so they need nothing further.

7// 2. The exact skills listed per repo in external-skills.json are installed

8// globally with the bundled `skills` CLI (falls back to `npx skills`), all

9// repos in parallel by default (throttle with KYH_SKILLS_CONCURRENCY; skip

10// with KYH_SKILLS_NO_EXTERNAL=1). Any other skill the CLI installed from

11// those repos is then removed, so every machine converges on the list.

12// 3. Non-universal agents (claude) get their own dirs symlinked to the

13// canonical store: ~/.claude/skills/<name> -> ~/.agents/skills/<name>.

14// 4. CLAUDE.md is copied to ~/.claude/CLAUDE.md and mcp.json merged into

15// ~/.claude.json.

16//

17// Copies, not symlinks, for anything sourced from the package: under `npx` the

18// package lives in a cache dir that is pruned and re-keyed per version, so a

19// link into it would dangle. What we copied is recorded in STATE_FILE, which is

20// how a skill dropped from the package gets removed and how a local edit to

21// ~/.claude/CLAUDE.md is told apart from our own last write (edits get a .bak).

23import { spawn, spawnSync } from "node:child_process";

24import { createHash } from "node:crypto";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install.mjsView on unpkg · L7

High

Child Process

Package source references child process execution.

scripts/install.mjsView on unpkg · L22

25import { once } from "node:events";

26import fs from "node:fs";

27import { createRequire } from "node:module";

28import os from "node:os";

29import path from "node:path";

31const require = createRequire(import.meta.url);

33const PKG_ROOT = path.resolve(import.meta.dirname, "..");

34const HOME = os.homedir();

35const AGENTS_DIR = path.join(HOME, ".agents");

36const CLAUDE_DIR = path.join(HOME, ".claude");

37const STATE_FILE = path.join(AGENTS_DIR, ".kyh-skills.json");

38const TAG = "[@kyh/skills]";

40let DRY = false;

41let failed = false;

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { spawn, spawnsync } from "node:child_process"; import { createhash } from "node:crypto"; import { once } from "node:events"; import fs from "node:fs"; import { createrequire } from "node:module"; import os from "node:os"; import path from "node:path"; const require = createrequire(import.meta.url); const pkg_root = path.resolve(import.meta.dirname, ".."); const home = os.homedir(); const agents_dir = path.join(home, ".agents"); const claude_dir = path.join(home, ".claude"); const state_file = path.join(agents_dir, ".kyh-skills.json"); const tag = "[@kyh/skills]"; let dry = false; let failed = false; const log = (...a) => console.log(tag, ...a); const warn = (...a) =>

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.mjsView on unpkg

package.jsonView file

Lines 1-30json

2 "name": "@kyh/skills",

3 "version": "0.2.1",

4 "description": "Personal Claude Code + Codex skills, MCP servers, and global instructions. `npx @kyh/skills install` copies them into a canonical ~/.agents store (and ~/.claude).",

5 "license": "MIT",

scripts/cli.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { check } from "./check.mjs";

3import { install } from "./install.mjs";

5const USAGE = `Usage: npx @kyh/skills@latest <command>

Source & flagged code

6 flagged · loading source

scripts/install.mjsView file

22L23: import { spawn, spawnSync } from "node:child_process"; L24: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

scripts/install.mjsView on unpkg · L22

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.mjsView on unpkg

7// 2. The exact skills listed per repo in external-skills.json are installed L8: // globally with the bundled `skills` CLI (falls back to `npx skills`), all L9: // repos in parallel by default (throttle with KYH_SKILLS_CONCURRENCY; skip ... L22: L23: import { spawn, spawnSync } from "node:child_process"; L24: import { createHash } from "node:crypto";

Findings

4 High2 Medium6 Low

HighChild Processscripts/install.mjs

HighShell

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install.mjs

HighRuntime Package Installscripts/install.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencescripts/cli.mjs

Affected versions and remediation

This report applies to @kyh/skills@0.2.1.

See all versions of @kyh/skills for other recorded verdicts.

Review the evidence and your use of @kyh/skills@0.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 04:12:36.566Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.