@skillsmith/cli@0.8.11
A registry for sharing, scanning, and tracking agent skills across teams.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe install-event code sends usage telemetry by default when a Skillsmith API key is available, while the README says analytics require explicit opt-in. The event contains skill metadata and a hashed key identifier, not the raw credential, so this is suspicious telemetry rather than credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user installs a skill through the CLI while a Skillsmith API key is available; the event is skipped only when SKILLSMITH_TELEMETRY is set to 0, false, or off.
Impact
Usage telemetry is collected without the documented opt-in, though the raw API key is not sent.
Mechanism
The CLI sends skill-install metadata and an HMAC-derived API-key identifier to the Skillsmith events endpoint.
AI rationale
The install-event code sends usage telemetry by default when a Skillsmith API key is available, while the README says analytics require explicit opt-in. The event contains skill metadata and a hashed key identifier, not the raw credential, so this is suspicious telemetry rather than credential exfiltration.
Evidence
README.mddist/cli.js
Network endpoints1
api.skillsmith.app/functions/v1/events
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- README.md says anonymous product analytics are opt-in and disabled by default, requiring SKILLSMITH_TELEMETRY_ENABLED=true.
- The bundled install-event sender checks SKILLSMITH_TELEMETRY only for opt-out values and sends when an API key is available.
- The CLI invokes that sender after skill installation, including skill ID, source, success, duration, trust tier, and error code.
- The event uses a keyed hash of the Skillsmith API key as its anonymous ID and targets the Skillsmith events endpoint.
Evidence against
- The install event does not include the raw API key; it uses an HMAC-derived identifier and sends skill-install metadata.
- The separate Claude Code hook template requires telemetry.enabled=true before sending invocation events.
- The manifest exposes a CLI executable and has no install lifecycle hook; prepublishOnly is a publish-time script.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
12 flaggeddist/cli.jsView file
50function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
L934: return stdout.trim();
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L5050Trigger-reachable chain: manifest.bin -> dist/cli.js
L50: function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powe
Findings
3 Critical7 High5 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltatemplates/skill-telemetry.sh
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.11.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.