registry / AI-agent capability abuse / agentic-awesome-skills / 17.1.0

agentic-awesome-skills@17.1.0

AAS Core: complete local skill discovery, agent-owned selection, stack validation, and planning, backed by 2,118+ agentic skills.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No malicious lifecycle hook, stealth execution, credential harvesting, or unconsented install-time control-surface mutation was found. The explicit CLI installer remains a meaningful agent-extension capability and warrants a warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the agentic-awesome-skills CLI without --dry-run.

Impact

Installed skills can influence the behavior of an AI coding agent.

Mechanism

Remote clone followed by copying managed skills into agent skill directories.

AI rationale

Evidence

tools/bin/install.js~/.agents/skills~/.codex/skills~/.antigravity-install-manifest.json

Network endpoints2

github.comapi.apify.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Its user-invoked installer targets AI-agent skill directories and writes managed skill entries there.
The installer clones a remote repository and installs the selected skill content after a user runs the command.
A bundled reference script sends the user-supplied actor input and token to the Apify API.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The agent-directory mutation is performed only by an explicit CLI invocation.
The Apify request is in a standalone reference script requiring explicit arguments and APIFY_TOKEN.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 216 file(s), 1.47 MB of source, external domains: amazon.com, api.apify.com, api.expo.dev, browserbase.com, console.apify.com, developers.notion.com, docs.anthropic.com, docs.stripe.com, fonts.googleapis.com, github.com, graph.facebook.com, huggingface.co, kit.svelte.dev, nextjs.org, platform.openai.com, prod.spline.design, registry.npmjs.org, turborepo.dev, vercel.com, web.dev, www.w3.org

Source & flagged code

11 flagged

skills/developer-signup-flow/SKILL.mdView file

165patternName = stripe_test_secret severity = high line = 165

High

High Secret

Package contains a high-severity secret pattern.

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

165patternName = stripe_test_secret severity = high line = 165

High

Secret Pattern

Stripe test secret key in skills/developer-signup-flow/SKILL.md

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

node_modules/ajv/dist/compile/jtd/serialize.jsView file

49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`; L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode); L51: const serialize = makeSerialize(this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49

tools/bin/aas.jsView file

3L4: const { main } = require("../lib/aas-v1/cli/main"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/bin/aas.jsView on unpkg · L3

skills/apify-content-analytics/reference/scripts/run_actor.jsView file

98const apiActorId = actorId.replace('/', '~'); L99: const url = `https://api.apify.com/v2/acts/${apiActorId}/runs?token=${encodeURIComponent(token)}`; L100: ... L102: try { L103: data = JSON.parse(inputJson); L104: } catch (e) { ... L114: }, L115: body: JSON.stringify(data), L116: }); ... L321: // Check for APIFY_TOKEN L322: const token = process.env.APIFY_TOKEN; L323: if (!token) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

skills/apify-content-analytics/reference/scripts/run_actor.jsView on unpkg · L98

skills/huggingface-tool-builder/references/baseline_hf_api.tsxView file

39L40: const token = process.env.HF_TOKEN; L41: const headers: Record<string, string> = token ... L44: L45: const url = `https://huggingface.co/api/models?limit=${limit}`; L46: ... L54: L55: const text = await res.text(); L56: process.stdout.write(text); L57: })();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

skills/huggingface-tool-builder/references/baseline_hf_api.tsxView on unpkg · L39

skills/gemini-deep-research/scripts/research.pyView file

•path = skills/gemini-deep-research/scripts/research.py kind = build_helper sizeBytes = 24204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/gemini-deep-research/scripts/research.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/fedora-hyprland-installer/tests/test-scripts.shView file

•path = skills/fedora-hyprland-installer/tests/test-scripts.sh kind = payload_in_excluded_dir sizeBytes = 1740 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/fedora-hyprland-installer/tests/test-scripts.shView on unpkg

node_modules/ajv/dist/refs/data.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/ajv/dist/refs/data.jsonView on unpkg

Source & flagged code

11 flagged · loading source

skills/developer-signup-flow/SKILL.mdView file

165patternName = stripe_test_secret severity = high line = 165

High

High Secret

Package contains a high-severity secret pattern.

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

165patternName = stripe_test_secret severity = high line = 165

High

Secret Pattern

Stripe test secret key in skills/developer-signup-flow/SKILL.md

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

node_modules/ajv/dist/compile/jtd/serialize.jsView file

Low

Findings

1 Critical6 High6 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationskills/apify-content-analytics/reference/scripts/run_actor.js

HighHigh Secretskills/developer-signup-flow/SKILL.md

HighCredential Exfiltrationskills/huggingface-tool-builder/references/baseline_hf_api.tsx

HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf

HighPayload In Excluded Dirskills/fedora-hyprland-installer/tests/test-scripts.sh

HighSemantic Analysis Limitednode_modules/ajv/dist/refs/data.json

HighSecret Patternskills/developer-signup-flow/SKILL.md

MediumDynamic Requiretools/bin/aas.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/gemini-deep-research/scripts/research.py

Affected versions and remediation

This report applies to agentic-awesome-skills@17.1.0.

See all versions of agentic-awesome-skills for other recorded verdicts.

Review the evidence and your use of agentic-awesome-skills@17.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 09:16:48.650Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code