agentic-awesome-skills@16.3.0
AAS Core: complete local skill discovery, agent-owned selection, stack validation, and planning, backed by 2,098+ agentic skills.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent skill installer, not an unconsented install-time control-surface mutation. Warn users about the broad agent-capability change, but do not block publication.
Static reason
One or more suspicious static signals were detected.
Trigger
An explicit invocation of the package installer with a target or selected skills.
Impact
Installed skill content can influence later agent behavior; the reviewed installer does not itself steal data or execute the copied skill content.
Mechanism
Clone a repository and stage-copy selected skill directories into agent skill paths.
AI rationale
This is an explicit-user-command AI-agent skill installer, not an unconsented install-time control-surface mutation. Warn users about the broad agent-capability change, but do not block publication.
Evidence
package.jsontools/bin/install.jstools/lib/aas-v1/cache/update.jstools/bin/aas.jstools/bin/aas-mcp.js
Network endpoints2
github.com/sickn33/agentic-awesome-skills.gitregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Its user-invoked installer can copy selected skill content into several AI-agent skill directories.
- The installer clones the package repository before copying the selected entries, so it imports remote skill content into those agent directories.
- The package also provides a registry updater, but it pins the npm origin and verifies tarball integrity.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- The agent-directory changes require an explicit CLI invocation and target or selection handling; they do not occur on package installation.
- Source uses path validation, staging, and a managed-entry manifest before replacing installed skill entries.
- No credential harvesting, secret exfiltration, hidden payload execution, or unconsented install-time agent-control mutation was found in inspected entrypoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
8 flagged · loading sourceskills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in skills/developer-signup-flow/SKILL.md
skills/developer-signup-flow/SKILL.mdView on unpkg · L165tools/bin/aas.jsView file
3L4: const { main } = require("../lib/aas-v1/cli/main");
L5:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
tools/bin/aas.jsView on unpkg · L3Findings
5 High6 Medium5 Low
HighHigh Secretskills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationskills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirskills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternskills/developer-signup-flow/SKILL.md
MediumDynamic Requiretools/bin/aas.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobskills/web-artifacts-builder/scripts/shadcn-components.tar.gz
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to agentic-awesome-skills@16.3.0.
See all versions of agentic-awesome-skills for other recorded verdicts.
- Review the evidence and your use of agentic-awesome-skills@16.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.