@skillsmith/cli@0.8.15
A registry for sharing, scanning, and tracking agent skills across teams.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends skill-install telemetry by default when an API key is present, unless an environment opt-out is set, and the reviewed documentation does not disclose this event. The payload excludes the raw key and goes to the package's own service, so this is suspicious telemetry rather than credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a CLI skill-install operation while a Skillsmith API key is available and telemetry has not been disabled.
Impact
The vendor can associate skill-install activity and outcomes with a pseudonymous account identifier; this is an undisclosed telemetry privacy risk.
Mechanism
The CLI sends an event containing skill identifier and installation metadata to https://api.skillsmith.app/functions/v1/events, associating it with an HMAC-derived API-key identifier.
AI rationale
The CLI sends skill-install telemetry by default when an API key is present, unless an environment opt-out is set, and the reviewed documentation does not disclose this event. The payload excludes the raw key and goes to the package's own service, so this is suspicious telemetry rather than credential exfiltration.
Evidence
dist/cli.jsREADME.md
Network endpoints1
api.skillsmith.app/functions/v1/events
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After a CLI skill installation, the package emits a skill_install event with skill ID, source, outcome, duration, trust tier, and error code metadata.
- The event is sent to the package's own api.skillsmith.app events endpoint and uses an HMAC-derived identifier from the Skillsmith API key.
- The install-event sender only checks for an opt-out flag and presence of an API key; it does not require telemetry to be enabled.
- The README describes a separate cross-machine inventory feature as opt-in, but does not disclose the automatic skill-install event in the reviewed excerpt.
- The manifest exposes the bundled CLI as its bin entry; its only lifecycle script is prepublishOnly.
Evidence against
- The collected event fields are limited to skill-install metadata; the API key itself is not included in the event payload.
- The actor identifier is HMAC-derived rather than the raw API key.
- The telemetry helper permits disabling events through SKILLSMITH_TELEMETRY=0/false/off.
- Device login sends client metadata to the Skillsmith API, consistent with the package's sign-in flow.
Behavioral surface
Source & flagged code
10 flaggeddist/cli.jsView file
50function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
L934: return stdout.trim();
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L5050Trigger-reachable chain: manifest.bin -> dist/cli.js
L50: function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powe
Findings
2 Critical6 High5 Medium7 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplates/skill-telemetry.sh
Medium
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.15.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.