registry / @nadernabil216/skillsmith / 0.4.0

@nadernabil216/skillsmith@0.4.0

skillsmith — a tool that carries a catalog of reusable AI-agent skills and installs any of them into the CLI agent you're using through a single line. One catalog, any agent (Claude, Codex, Gemini, Kimi, GLM, opencode), versioned and kept in sync.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 29.7 KB of source, external domains: registry.npmjs.org

Source & flagged code

2 flagged

bin/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// skillsmith — install a versioned catalog of agent skills into any CLI agent.

3import { parseArgs } from 'node:util';

4import { execSync, spawnSync } from 'node:child_process';

5import os from 'node:os';

High

Child Process

Package source references child process execution.

bin/cli.js

Source & flagged code

2 flagged · loading source

bin/cli.jsView file

3import { parseArgs } from 'node:util'; L4: import { execSync, spawnSync } from 'node:child_process'; L5: import os from 'node:os';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

212try { L213: execSync(`npm install -g ${pkg.name}@latest`, { stdio: 'inherit' }); L214: // Re-exec the freshly installed binary to apply the new skills.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L212

Findings

3 High3 Medium5 Low

HighChild Processbin/cli.js

HighShell

HighRuntime Package Installbin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 192-232javascript

192// Look up the latest published version on the npm registry (no extra deps).

193async function latestPublished(name) {

194 try {

195 const res = await fetch(`https://registry.npmjs.org/${name.replace('/', '%2f')}/latest`, {

196 headers: { accept: 'application/json' },

197 });

198 if (!res.ok) return null;

199 return (await res.json()).version || null;

200 } catch { return null; }

201}

202

203async function cmdUpdate() {

204 const pkg = await pkgInfo();

205 const current = pkg.version;

206

207 // 1) Try to pull a newer catalog from npm (unless told to skip, e.g. under npx@latest).

208 if (!flags['no-self-upgrade']) {

209 const latest = await latestPublished(pkg.name);

210 if (latest && compareVersions(latest, current) > 0) {

211 log.info(`Newer catalog available: ${current} → ${latest}. Upgrading…`);

212 try {

213 execSync(`npm install -g ${pkg.name}@latest`, { stdio: 'inherit' });

214 // Re-exec the freshly installed binary to apply the new skills.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L212

215 const prefix = execSync('npm prefix -g').toString().trim();

216 const bin = path.join(prefix, 'bin', 'skillsmith');

217 const r = spawnSync(bin, ['sync', ...(flags.agent ? ['--agent', flags.agent] : []), ...(flags.global ? ['--global'] : [])], { stdio: 'inherit' });

218 process.exit(r.status ?? 0);

219 } catch {

220 log.warn('Self-upgrade failed (not a global install?). Re-syncing current catalog instead.');

221 log.dim(`Tip: run \`npx ${pkg.name}@latest update --no-self-upgrade\` to get the latest.`);

222 }

223 } else {

224 log.ok(`Catalog already at the latest version (${current}).`);

225 }

226 }

227

228 // 2) Re-sync the locked skills from whatever catalog is now running.

229 await guardDestructive('sync');

230 await syncProject(projectRoot, flags.agent, opts);

231}

232