registry / @loopskills/claude-skills / 0.4.2

@loopskills/claude-skills@0.4.2

Research-driven planning, debugging, and audit skills for Claude Code and Pi

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 21.0 KB of source, external domains: registry.npmjs.org

Source & flagged code

3 flagged

dist/src/install.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import * as p from '@clack/prompts';

3import { groupMultiselect } from '@clack/prompts';

4import { cp, mkdir, readFile, writeFile, access, readdir } from 'node:fs/promises';

5import { createReadStream }

Source & flagged code

3 flagged · loading source

dist/src/install.jsView file

9import { fileURLToPath } from 'node:url'; L10: import { execSync } from 'node:child_process'; L11: const __dirname = dirname(fileURLToPath(import.meta.url));

High

Child Process

Package source references child process execution.

dist/src/install.jsView on unpkg · L9

353} L354: execSync(`npm install -g ${PKG_NAME}@latest`, { stdio: 'inherit' }); L355: p.outro('Update complete. Re-run claude-skills to install updated skill files.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/install.jsView on unpkg · L353

bin/verify-internet-research.pyView file

•path = bin/verify-internet-research.py kind = build_helper sizeBytes = 14111 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/verify-internet-research.pyView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/src/install.js

HighShell

HighRuntime Package Installdist/src/install.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/verify-internet-research.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 333-373javascript

333 installedVersion = receipt.version;

334 }

335 catch { /* no receipt */ }

336 const spinner = p.spinner();

337 spinner.start('Checking npm registry…');

338 try {

339 const res = await fetch(`https://registry.npmjs.org/-/package/${PKG_NAME}/dist-tags`, { signal: AbortSignal.timeout(5000) });

340 const data = await res.json();

341 const latest = data['latest'];

342 spinner.stop('Done.');

343 if (latest === installedVersion) {

344 p.outro(`Already up to date (v${installedVersion}).`);

345 return;

346 }

347 const proceed = await p.confirm({

348 message: `Version ${latest} available (installed: ${installedVersion}). Update?`,

349 });

350 if (p.isCancel(proceed) || !proceed) {

351 p.cancel('Cancelled.');

352 return;

353 }

354 execSync(`npm install -g ${PKG_NAME}@latest`, { stdio: 'inherit' });

355 p.outro('Update complete. Re-run claude-skills to install updated skill files.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/install.jsView on unpkg · L353

356 }

357 catch {

358 spinner.stop('Could not reach registry.');

359 p.outro('Try: npm install -g @loopskills/claude-skills@latest');

360 }

361}

362async function listCommand() {

363 const receiptPath = join(CLAUDE_DIR, 'skills', '.install-receipt.json');

364 try {

365 const receipt = JSON.parse(await readFile(receiptPath, 'utf8'));

366 console.log(`Installed version: ${receipt.version} (${receipt.installed_at})`);

367 console.log(`Skills: ${receipt.skills.join(', ')}`);

368 console.log(`Agents: ${receipt.agents.join(', ')}`);

369 }

370 catch {

371 console.log('No install receipt found. Run claude-skills to install.');

372 }

373}