registry / @skillsmith/cli / 0.8.10
@skillsmith/cli@0.8.10
A registry for sharing, scanning, and tracking agent skills across teams.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has no install hook, and the flagged Claude Code settings mutation occurs only through an explicit telemetry hook installation command. The hook sends limited anonymous skill usage data only after telemetry is enabled; GitHub credentials are used for GitHub API requests in the import feature.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Users run CLI commands; telemetry collection requires explicit enablement, and hook installation requires an explicit install-hook command.
Impact
No unauthorized credential transfer or automatic mutation was identified. The hook changes Claude Code settings only when explicitly installed.
Mechanism
The CLI uses its service API for login and features, GitHub's API for imports, and an optional hook that sends anonymous skill invocation data when enabled.
AI rationale
The package has no install hook, and the flagged Claude Code settings mutation occurs only through an explicit telemetry hook installation command. The hook sends limited anonymous skill usage data only after telemetry is enabled; GitHub credentials are used for GitHub API requests in the import feature.
Evidence
~/.skillsmith/config.json~/.skillsmith/hooks/skill-telemetry.sh~/.claude/settings.json
Network endpoints3
api.skillsmith.appvrcnzpmndtroqxxoqkzy.supabase.coapi.github.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI binary and has no preinstall, install, or postinstall hook; prepublishOnly is a build-and-test script.
- The telemetry hook requires telemetry to be enabled in the user's config and has a disable switch.
- The hook payload uses an anonymous ID and skill/session timing fields; its source says it does not include arguments, paths, or environment variables.
- Installing the Claude Code hook and enabling telemetry are separate, named CLI commands.
- GitHub tokens are used in requests to the GitHub API for the explicit GitHub import feature.
Evidence against
- The CLI and optional telemetry hook make network requests and write configuration when their commands are used.
- The telemetry hook can write to the user's Claude Code settings file when explicitly installed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggeddist/cli.jsView file
819import { promisify } from "node:util";
L820: import childProcess from "node:child_process";
L821: var execFile, powerShellPath, executePowerShell;
High
815L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"claude-code": join(homedir(), ".claude", "skills"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
// `.claude/agents`)") -- this codebase already has independently
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
1 Critical6 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltatemplates/skill-telemetry.sh
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplates/skill-telemetry.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.10.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.