registry / AI-agent capability abuse / agentic-awesome-skills / 16.6.0

agentic-awesome-skills@16.6.0

AAS Core: complete local skill discovery, agent-owned selection, stack validation, and planning, backed by 2,108+ agentic skills.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a user-invoked agent-extension installer with broad capability impact, so it warrants a warning. Source inspection found no automatic lifecycle hook or concrete malicious payload chain.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the package's installer bin command without dry-run mode.

Impact

Installed skill content can influence supported AI-agent environments and replace previously managed entries.

Mechanism

Remote repository cloning and skill-directory mutation.

AI rationale

This is a user-invoked agent-extension installer with broad capability impact, so it warrants a warning. Source inspection found no automatic lifecycle hook or concrete malicious payload chain.

Evidence

tools/bin/install.jsskills/apify-content-analytics/reference/scripts/run_actor.jsskills/huggingface-tool-builder/references/baseline_hf_api.tsx~/.codex/skills~/.agents/skills~/.cursor/skills~/.claude/skills~/.gemini/skills~/.kiro/skills

Network endpoints4

github.com/sickn33/agentic-awesome-skills.gitregistry.npmjs.orgapi.apify.comhuggingface.co

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The executable installer targets several AI-agent skill directories, including Codex and Antigravity.
On explicit execution, the installer clones a remote repository and installs its selected contents into those agent directories.
The package ships a large skill catalog containing user-run scripts that send supplied tokens and input to external service APIs.

Evidence against

package.json contains no preinstall, install, or postinstall lifecycle hook.
The installer is a bin command, so its mutation requires a user invoking it.
The Apify and Hugging Face examples use named environment tokens for their corresponding service endpoints; no source shows unrelated credential harvesting.
The Fedora installer finding is an isolated test runner that sets HOME to a temporary directory.
The PDF is a ReportLab-generated document, not an inspectable executable payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEval

Source & flagged code

12 flagged

skills/developer-signup-flow/SKILL.mdView file

165patternName = stripe_test_secret severity = high line = 165

High

High Secret

Package contains a high-severity secret pattern.

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

165patternName = stripe_test_secret severity = high line = 165

High

Secret Pattern

Stripe test secret key in skills/developer-signup-flow/SKILL.md

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

node_modules/ajv/dist/compile/jtd/serialize.jsView file

49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`; L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode); L51: const serialize = makeSerialize(this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49

tools/bin/aas.jsView file

3L4: const { main } = require("../lib/aas-v1/cli/main"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/bin/aas.jsView on unpkg · L3

skills/apify-content-analytics/reference/scripts/run_actor.jsView file

98const apiActorId = actorId.replace('/', '~'); L99: const url = `https://api.apify.com/v2/acts/${apiActorId}/runs?token=${encodeURIComponent(token)}`; L100: ... L102: try { L103: data = JSON.parse(inputJson); L104: } catch (e) { ... L114: }, L115: body: JSON.stringify(data), L116: }); ... L321: // Check for APIFY_TOKEN L322: const token = process.env.APIFY_TOKEN; L323: if (!token) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

skills/apify-content-analytics/reference/scripts/run_actor.jsView on unpkg · L98

skills/huggingface-tool-builder/references/baseline_hf_api.tsxView file

39L40: const token = process.env.HF_TOKEN; L41: const headers: Record<string, string> = token ... L44: L45: const url = `https://huggingface.co/api/models?limit=${limit}`; L46: ... L54: L55: const text = await res.text(); L56: process.stdout.write(text); L57: })();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

skills/huggingface-tool-builder/references/baseline_hf_api.tsxView on unpkg · L39

skills/gemini-deep-research/scripts/research.pyView file

•path = skills/gemini-deep-research/scripts/research.py kind = build_helper sizeBytes = 24204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/gemini-deep-research/scripts/research.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/fedora-hyprland-installer/tests/test-scripts.shView file

•path = skills/fedora-hyprland-installer/tests/test-scripts.sh kind = payload_in_excluded_dir sizeBytes = 1740 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/fedora-hyprland-installer/tests/test-scripts.shView on unpkg

node_modules/ajv/dist/refs/data.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/ajv/dist/refs/data.jsonView on unpkg

tools/bin/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agentic-awesome-skills@17.1.0 matchedIdentity = npm:YWdlbnRpYy1hd2Vzb21lLXNraWxscw:17.1.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tools/bin/install.jsView on unpkg

Source & flagged code

12 flagged · loading source

skills/developer-signup-flow/SKILL.mdView file

165patternName = stripe_test_secret severity = high line = 165

High

High Secret

Package contains a high-severity secret pattern.

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

165patternName = stripe_test_secret severity = high line = 165

High

Secret Pattern

Stripe test secret key in skills/developer-signup-flow/SKILL.md

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

node_modules/ajv/dist/compile/jtd/serialize.jsView file

Low

Findings

2 Critical6 High6 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationskills/apify-content-analytics/reference/scripts/run_actor.js

CriticalPrevious Version Dangerous Deltatools/bin/install.js

HighHigh Secretskills/developer-signup-flow/SKILL.md

HighCredential Exfiltrationskills/huggingface-tool-builder/references/baseline_hf_api.tsx

HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf

HighPayload In Excluded Dirskills/fedora-hyprland-installer/tests/test-scripts.sh

HighSemantic Analysis Limitednode_modules/ajv/dist/refs/data.json

HighSecret Patternskills/developer-signup-flow/SKILL.md

MediumDynamic Requiretools/bin/aas.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to agentic-awesome-skills@16.6.0.

See all versions of agentic-awesome-skills for other recorded verdicts.

Review the evidence and your use of agentic-awesome-skills@16.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 00:13:59.642Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code