agentic-awesome-skills@16.0.0
AAS Core: complete local skill discovery, agent-owned selection, stack validation, and planning, backed by 2,026+ agentic skills.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent capability installer, not concrete malware. Warn so consumers review selected skill content before enabling it in an agent.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the package CLI with an agent target and an explicit selection or --all.
Impact
Installed skill content can affect the behavior and available capabilities of the selected AI agent.
Mechanism
Clone and copy managed skill directories into agent control-surface paths.
AI rationale
This is an explicit-user-command AI-agent capability installer, not concrete malware. Warn so consumers review selected skill content before enabling it in an agent.
Evidence
package.jsontools/bin/install.jstools/lib/aas-v1/cache/update.jsskills/fedora-hyprland-installer/tests/test-scripts.shskills/huggingface-tool-builder/references/baseline_hf_api.tsx~/.cursor/skills~/.claude/skills~/.gemini/skills~/.codex/skills~/.kiro/skills~/.agents/skills.antigravity-install-manifest.json
Network endpoints2
github.com/sickn33/agentic-awesome-skills.gitregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit CLI installer targets Cursor, Claude, Gemini, Codex, Kiro, and .agents skill directories.
- Installer clones the upstream skills repository, then writes and prunes managed skill entries in the selected agent directory.
Evidence against
- package.json contains no npm preinstall, install, or postinstall lifecycle hook.
- Antigravity installs without a selection are stopped before cloning or file changes.
- Release installs resolve npm gitHead and reject a cloned commit mismatch.
- Catalog updater only accepts HTTPS resources from registry.npmjs.org and verifies tarball integrity.
- Flagged Hugging Face code is a user-run example that sends only its optional HF_TOKEN to huggingface.co.
- The shell finding is an isolated non-destructive test runner.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
8 flagged · loading sourceskills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in skills/developer-signup-flow/SKILL.md
skills/developer-signup-flow/SKILL.mdView on unpkg · L165tools/bin/aas.jsView file
3L4: const { main } = require("../lib/aas-v1/cli/main");
L5:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
tools/bin/aas.jsView on unpkg · L3Findings
5 High6 Medium5 Low
HighHigh Secretskills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationskills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirskills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternskills/developer-signup-flow/SKILL.md
MediumDynamic Requiretools/bin/aas.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobskills/web-artifacts-builder/scripts/shadcn-components.tar.gz
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to agentic-awesome-skills@16.0.0.
See all versions of agentic-awesome-skills for other recorded verdicts.
- Review the evidence and your use of agentic-awesome-skills@16.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.