registry / @lion1ou/skill-ctl / 1.2.1
@lion1ou/skill-ctl@1.2.1
Configuration-driven Agent Skill catalog installer.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install-time hook, and the flagged network and subprocess operations are reached through explicit skill catalog or installation flows. The manager server binds only to loopback and protects write operations with a random token.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the add or install command, or starts the local manager.
Impact
These actions may contact skills.sh and stage or distribute user-selected skill files. No automatic credential collection, unrelated data transmission, or install-time attack was identified.
Mechanism
The CLI searches skills.sh, invokes the skills CLI for a specified external repository, and stages selected skills for installation; the manager listens on loopback with a random token.
AI rationale
The manifest has no install-time hook, and the flagged network and subprocess operations are reached through explicit skill catalog or installation flows. The manager server binds only to loopback and protects write operations with a random token.
Evidence
dist/commands/add.jsdist/commands/install.jsdist/core/catalog-install.jsdist/core/manager-server.jsdist/core/skills-source.js
Network endpoints2
skills.sh/api/search127.0.0.1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines build, test, prepack, and prepublishOnly scripts, with no install-time lifecycle hook.
- The add command requires a user-provided query or owner/repo and uses it to register external skills.
- The skills.sh search and external-skill preparation occur through the add/install feature flows.
- The manager server binds to 127.0.0.1 and uses a random token to protect write operations.
Evidence against
- The package provides an installer for agent skills; subprocess use downloads or inspects skills selected through its CLI.
- The install command checks the selected skills before preparing and distributing them.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/dev-session.jsView file
1import { execFileSync, spawn } from 'node:child_process';
L2: import { readFileSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/dev-session.jsView on unpkg · L1dist/core/workspace-picker.jsView file
27return {
L28: file: 'powershell.exe',
L29: args: [
High
dist/core/skills-source.jsView file
21export function inspectPackageSkills(packageId) {
L22: const result = spawnSync('npx', ['-y', 'skills', 'add', packageId, '-l'], {
L23: encoding: 'utf8',
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/core/catalog-install.js
HighChild Processdist/dev-session.js
HighShelldist/core/workspace-picker.js
HighRuntime Package Installdist/core/skills-source.js
HighSemantic Analysis Limiteddist/core/workspace-picker.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lion1ou/skill-ctl@1.2.1.
See all versions of @lion1ou/skill-ctl for other recorded verdicts.
- Review the evidence and your use of @lion1ou/skill-ctl@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.