registry / @skillsmith/cli / 0.8.1
@skillsmith/cli@0.8.1
CLI tools for Skillsmith skill discovery and authentication
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsObfuscatedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
25885patternName = supabase_service_key
severity = critical
line = 25885
matchedText = var PROD...t8";
Critical
25885patternName = supabase_service_key
severity = critical
line = 25885
matchedText = var PROD...t8";
Critical
50function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
L934: return stdout.trim();
Findings
2 Critical1 High5 Medium7 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplates/skill-telemetry.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.1.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.