@lion1ou/skill-ctl@1.2.3
Configuration-driven Agent Skill catalog installer.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package enables runtime analytics to its vendor when the management UI is used, and I found no user-facing disclosure in the README. The source describes limited collection and provides an opt-out, so this is suspicious telemetry rather than malicious data theft.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs skill-ctl manage and opens a served management page.
Impact
The vendor receives page visit, frontend error, and performance telemetry. The source says skill content, paths, and tokens are excluded.
Mechanism
The server injects a remote analytics SDK that reports to https://track.lion1ou.tech; SKILLCTL_NO_TELEMETRY disables it.
AI rationale
The package enables runtime analytics to its vendor when the management UI is used, and I found no user-facing disclosure in the README. The source describes limited collection and provides an opt-out, so this is suspicious telemetry rather than malicious data theft.
Evidence
dist/core/telemetry.jsdist/core/manager-server.jsdist/commands/manage.js
Network endpoints1
track.lion1ou.tech
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The management UI injects a telemetry SDK that reports to https://track.lion1ou.tech; telemetry is enabled by default unless SKILLCTL_NO_TELEMETRY is set.
- The SDK is injected when the local management server serves its pages, and the server is started by the explicit manage command.
Evidence against
- The source says telemetry collects page visits, frontend errors, and performance data, not skill content, paths, or tokens; it also documents an environment-variable opt-out.
- The npx skills add operation is part of the install flow for selected skills, rather than an install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/dev-session.jsView file
1import { execFileSync, spawn } from 'node:child_process';
L2: import { readFileSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/dev-session.jsView on unpkg · L1dist/core/skills-source.jsView file
21export function inspectPackageSkills(packageId) {
L22: const result = spawnSync('npx', ['-y', 'skills', 'add', packageId, '-l'], {
L23: encoding: 'utf8',
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/core/skills-source.jsView on unpkg · L21dist/core/catalog-install.jsView file
Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/core/catalog-install.js
HighChild Processdist/dev-session.js
HighRuntime Package Installdist/core/skills-source.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/core/telemetry.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lion1ou/skill-ctl@1.2.3.
See all versions of @lion1ou/skill-ctl for other recorded verdicts.
- Review the evidence and your use of @lion1ou/skill-ctl@1.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.