@skillsmith/cli@0.8.9
A registry for sharing, scanning, and tracking agent skills across teams.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source shows default runtime telemetry that can include identifying account metadata, despite documentation describing telemetry as opt-in. The telemetry goes to the package's own service, so this warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A namespace audit completes while audit mode is not off.
Impact
The service receives identifying account metadata and audit result counts without the documented opt-in setting being required.
Mechanism
The CLI posts an audit event to its own service unless SKILLSMITH_TELEMETRY is set to 0, false, or off. The payload can include user_id and an HMAC-derived API-key identifier.
AI rationale
The source shows default runtime telemetry that can include identifying account metadata, despite documentation describing telemetry as opt-in. The telemetry goes to the package's own service, so this warrants a warning rather than a malicious verdict.
Evidence
dist/cli.jsREADME.md
Network endpoints1
api.skillsmith.app/functions/v1/events
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Namespace audit completion sends telemetry whenever audit mode is not off and SKILLSMITH_TELEMETRY is not explicitly disabled.
- The audit event includes a user_id when available and an HMAC-derived identifier based on the Skillsmith API key.
- The README describes telemetry as disabled by default and requiring explicit opt-in via SKILLSMITH_TELEMETRY_ENABLED=true.
- The API key lookup uses SKILLSMITH_API_KEY or the local Skillsmith config, and the telemetry endpoint is api.skillsmith.app.
Evidence against
- The telemetry is sent to the package's own Skillsmith service, not an unrelated collector.
- The README documents the namespace audit feature and describes telemetry as opt-in.
- The Claude Code telemetry hook requires an explicit install-hook command and an enabled telemetry setting.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggeddist/cli.jsView file
819import { promisify } from "node:util";
L820: import childProcess from "node:child_process";
L821: var execFile, powerShellPath, executePowerShell;
High
815L816: // ../../node_modules/powershell-utils/index.js
L817: import process5 from "node:process";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"claude-code": join(homedir(), ".claude", "skills"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
// `.claude/agents`)") -- this codebase already has independently
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
dir: join(homedir(), ".claude", "agents"),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
1 Critical6 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltatemplates/skill-telemetry.sh
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplates/skill-telemetry.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @skillsmith/cli@0.8.9.
See all versions of @skillsmith/cli for other recorded verdicts.
- Review the evidence and your use of @skillsmith/cli@0.8.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.