registry / @skilletmd/cli / 0.1.34

@skilletmd/cli@0.1.34

Your skills, everywhere. Agent skills that sync to every computer, agent, and surface you use.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 969 KB of source, external domains: 127.0.0.1, api.github.com, github.com, raw.githubusercontent.com, registry.skillet.md, skillet.md

Source & flagged code

5 flagged

bin/skillet.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

2/**

3 * npm launcher: exec the platform optionalDependency binary when installed,

4 * otherwise fall back to the bundled CJS entry (monorepo / unpublished layouts).

5 */

6import { spawnSync } from 'node:child_process';

7import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/skillet.jsView on unpkg · L5

8import { existsSync } from 'node:fs';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

12const require = createRequire(import.meta.url);

13const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), '..');

15/** @type {Record<string, string>} */

16const PLATFORM_PACKAGES = {

17 'darwin-arm64': '@skilletmd/cli-darwin-arm64',

18 'darwin-x64': '@skilletmd/cli-darwin-x64',

19 'linux-x64': '@skilletmd/cli-linux-x64',

20 'linux-arm64': '@skilletmd/cli-linux-arm64',

21 'win32-x64': '@skilletmd/cli-win32-x64',

22};

24function resolveNativeBinary() {

25 const pkgName = PLATFORM_PACKAGES[`${process.platform}-${process.arch}`];

26 if (!pkgName) return null;

27 try {

28 const pkgJson = require.resolve(`${pkgName}/package.json`);

29 const binName = process.platform === 'win32' ? 'skillet.exe' : 'skillet';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/skillet.jsView on unpkg · L5

30 const candidate = join(dirname(pkgJson), 'bin', binName);

31 return existsSync(candidate) ? candidate : null;

32 } catch {

33 return null;

34 }

35}

37function execAndExit(command, args) {

38 const result = spawnSync(command, args, { stdio: 'inherit' });

High

Shell

Package source references shell execution.

bin/skillet.jsView on unpkg · L36

39 if (result.error) {

40 console.error(result.error.message);

41 process.exit(1);

42 }

43 process.exit(result.status ?? 1);

44}

46const native = resolveNativeBinary();

47if (native) {

48 execAndExit(native, process.argv.slice(2));

49}

51const cjs = join(pkgRoot, 'dist', 'cli.cjs');

52if (!existsSync(cjs)) {

53 console.error(

54 'Skillet CLI: no native binary for this platform and dist/cli.cjs is missing. Run `pnpm bundle` in the monorepo or reinstall @skilletmd/cli.',

55 );

56 process.exit(1);

dist/cli.cjsView file

42* Constructs the CommanderError class L43: * @param {number} exitCode suggested exit code which could be used with process.exit L44: * @param {string} code an id string representing the error ... L968: var EventEmitter = require("node:events").EventEmitter; L969: var childProcess = require("node:child_process"); L970: var path = require("node:path"); ... L1017: this._outputConfiguration = { L1018: writeOut: (str2) => process2.stdout.write(str2), L1019: writeErr: (str2) => process2.stderr.write(str2), ... L1053: * @returns {Command[]} L1054: * @private L1055: */

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L42

6685if (ast.body[0].expression.body.type === "BlockStatement") { L6686: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L6687: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.cjsView on unpkg · L6685

Source & flagged code

5 flagged · loading source

bin/skillet.jsView file

5*/ L6: import { spawnSync } from 'node:child_process'; L7: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/skillet.jsView on unpkg · L5

36L37: function execAndExit(command, args) { L38: const result = spawnSync(command, args, { stdio: 'inherit' });

High

Shell

Package source references shell execution.

bin/skillet.jsView on unpkg · L36

5Cross-file remote execution chain: bin/skillet.js spawns dist/cli.cjs; helper contains network access plus dynamic code execution. L5: */ L6: import { spawnSync } from 'node:child_process'; L7: import { createRequire } from 'node:module'; ... L24: function resolveNativeBinary() { L25: const pkgName = PLATFORM_PACKAGES[`${process.platform}-${process.arch}`]; L26: if (!pkgName) return null; L27: try { L28: const pkgJson = require.resolve(`${pkgName}/package.json`); L29: const binName = process.platform === 'win32' ? 'skillet.exe' : 'skillet';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/skillet.jsView on unpkg · L5

dist/cli.cjsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L42

6685if (ast.body[0].expression.body.type === "BlockStatement") { L6686: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L6687: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.cjsView on unpkg · L6685

Findings

4 High3 Medium5 Low

HighChild Processbin/skillet.js

HighShellbin/skillet.js

HighObfuscated Payload Loaderdist/cli.cjs

HighCross File Remote Execution Contextbin/skillet.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/cli.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/skillet.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

2/**

3 * npm launcher: exec the platform optionalDependency binary when installed,

4 * otherwise fall back to the bundled CJS entry (monorepo / unpublished layouts).

5 */

6import { spawnSync } from 'node:child_process';

7import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/skillet.jsView on unpkg · L5

8import { existsSync } from 'node:fs';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

12const require = createRequire(import.meta.url);

13const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), '..');

15/** @type {Record<string, string>} */

16const PLATFORM_PACKAGES = {

17 'darwin-arm64': '@skilletmd/cli-darwin-arm64',

18 'darwin-x64': '@skilletmd/cli-darwin-x64',

19 'linux-x64': '@skilletmd/cli-linux-x64',

20 'linux-arm64': '@skilletmd/cli-linux-arm64',

21 'win32-x64': '@skilletmd/cli-win32-x64',

22};

24function resolveNativeBinary() {

25 const pkgName = PLATFORM_PACKAGES[`${process.platform}-${process.arch}`];

26 if (!pkgName) return null;

27 try {

28 const pkgJson = require.resolve(`${pkgName}/package.json`);

29 const binName = process.platform === 'win32' ? 'skillet.exe' : 'skillet';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/skillet.jsView on unpkg · L5

30 const candidate = join(dirname(pkgJson), 'bin', binName);

31 return existsSync(candidate) ? candidate : null;

32 } catch {

33 return null;

34 }

35}

37function execAndExit(command, args) {

38 const result = spawnSync(command, args, { stdio: 'inherit' });

High

Shell

Package source references shell execution.

bin/skillet.jsView on unpkg · L36

39 if (result.error) {

40 console.error(result.error.message);

41 process.exit(1);

42 }

43 process.exit(result.status ?? 1);

44}

46const native = resolveNativeBinary();

47if (native) {

48 execAndExit(native, process.argv.slice(2));

49}

51const cjs = join(pkgRoot, 'dist', 'cli.cjs');

52if (!existsSync(cjs)) {

53 console.error(

54 'Skillet CLI: no native binary for this platform and dist/cli.cjs is missing. Run `pnpm bundle` in the monorepo or reinstall @skilletmd/cli.',

55 );

56 process.exit(1);

dist/cli.cjsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L42

6685if (ast.body[0].expression.body.type === "BlockStatement") { L6686: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L6687: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.cjsView on unpkg · L6685