registry / @skillsmith/cli / 0.8.12
@skillsmith/cli@0.8.12
A registry for sharing, scanning, and tracking agent skills across teams.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s install lifecycle does not run the flagged behavior. The telemetry hook is installed and enabled through separate CLI commands, and its collection is gated by local opt-in configuration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Telemetry requires the user to install the hook and enable telemetry; the hook runs on Claude Code Skill tool events.
Impact
Telemetry reports skill invocation metadata; reviewed source does not show automatic installation-time collection or credential transmission.
Mechanism
The hook checks local configuration, then can send an anonymous event to the configured endpoint. It extracts the skill name and session ID, and records duration and platform.
AI rationale
The package’s install lifecycle does not run the flagged behavior. The telemetry hook is installed and enabled through separate CLI commands, and its collection is gated by local opt-in configuration.
Evidence
~/.skillsmith/config.json~/.skillsmith/hooks/skill-telemetry.sh~/.claude/settings.json
Network endpoints1
vrcnzpmndtroqxxoqkzy.supabase.co
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has only a prepublishOnly script for a publish guard, build, and tests; there is no install lifecycle hook.
- Telemetry hook installation is a separate CLI command, and it instructs the user to run `skillsmith telemetry enable` before collection starts.
- The hook exits unless local configuration sets telemetry.enabled to true; it reads only the session ID and skill name from the hook payload, not tool arguments.
- When enabled, the hook sends an anonymous skill-invocation event with the skill name, session ID, duration, and platform; the script states that paths and environment variables are excluded.
Evidence against
- The telemetry template contains an outbound endpoint, but sending is gated by explicit telemetry enablement.
- The CLI writes a hook to Claude settings only through the explicit install-hook command; this does not happen during package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
12 flaggeddist/cli.jsView file
50function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
L934: return stdout.trim();
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L5050Trigger-reachable chain: manifest.bin -> dist/cli.js
L50: function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powe
Findings
3 Critical7 High5 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltatemplates/skill-telemetry.sh
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.12.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.