@skillsmith/cli@0.8.8
A registry for sharing, scanning, and tracking agent skills across teams.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source shows an explicit, opt-in agent hook installer rather than an automatic lifecycle mutation. Its persistent agent configuration and telemetry behavior fit a guarded capability warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the telemetry hook installation command and enables telemetry; Claude Code then invokes the installed hook.
Impact
This is a guarded agent-configuration capability and can transmit skill names, session identifiers, duration, and platform after opt-in; no confirmed covert attack surface was established.
Mechanism
The CLI writes hook settings and copies a shell script. The script gates on local configuration, builds an anonymous invocation record, and posts it to the selected endpoint.
AI rationale
The source shows an explicit, opt-in agent hook installer rather than an automatic lifecycle mutation. Its persistent agent configuration and telemetry behavior fit a guarded capability warning.
Evidence
dist/cli.jstemplates/skill-telemetry.sh~/.claude/settings.json~/.skillsmith/hooks/skill-telemetry.sh~/.skillsmith/config.json
Network endpoints1
vrcnzpmndtroqxxoqkzy.supabase.co/functions/v1/events
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes a CLI entry point and has no npm install lifecycle hook.
- An explicit telemetry command can install a Claude Code Skill hook into user or project settings.
- The installer copies its telemetry script and writes the resulting hook settings.
- The hook exits unless local telemetry is enabled and sends a limited invocation payload to its configured endpoint.
Evidence against
- The telemetry hook can persist as an AI-agent configuration change after an explicit user command.
- The install command permits overriding the telemetry endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"claude-code": join(homedir(), ".claude", "skills"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
// `.claude/agents`)") -- this codebase already has independently
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg50function createLoggerInstance(namespace) {
L51: const useJson = process.env.LOG_FORMAT === "json";
L52: const minLevel = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL, 10) : LogLevel.WARN;
...
L815:
L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
...
L850: ];
L851: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64");
L852: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
...
L932: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
L933: const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
L934: return stdout.trim();
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
4 High5 Medium6 Low
HighCredential Redirect Persistencedist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighPrevious Version Dangerous Deltatemplates/skill-telemetry.sh
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplates/skill-telemetry.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.8.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.