registry / @lion1ou/skill-ctl / 1.1.0
@lion1ou/skill-ctl@1.1.0
Configuration-driven Agent Skill catalog installer.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/dev-session.jsView file
1import { execFileSync, spawn } from 'node:child_process';
L2: import { fileURLToPath } from 'node:url';
High
Child Process
Package source references child process execution.
dist/dev-session.jsView on unpkg · L1dist/core/workspace-picker.jsView file
27return {
L28: file: 'powershell.exe',
L29: args: [
High
dist/core/skills-source.jsView file
21export function inspectPackageSkills(packageId) {
L22: const result = spawnSync('npx', ['-y', 'skills', 'add', packageId, '-l'], {
L23: encoding: 'utf8',
Findings
3 High3 Medium5 Low
HighChild Processdist/dev-session.js
HighShelldist/core/workspace-picker.js
HighRuntime Package Installdist/core/skills-source.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lion1ou/skill-ctl@1.1.0.
See all versions of @lion1ou/skill-ctl for other recorded verdicts.
- Review the evidence and your use of @lion1ou/skill-ctl@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.