agentic-awesome-skills@18.2.0
AAS Core: complete local skill discovery, agent-owned selection, stack validation, and planning, backed by 2,445+ agentic skills.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe installer is an explicit user command that writes skill files into foreign agent skill directories, including a default home .agents/skills target, so it matches explicit user-command agent setup rather than a silent install hook. No preinstall, install, or postinstall script runs that copy, and the handoff path uses ignore-scripts plus dry-run.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User execution of the agentic-awesome-skills bin, including a default run with no agent flag.
Impact
Agent clients that load those directories can later follow the installed skill text and any scripts bundled inside the skills. The install step itself does not harvest credentials or launch a hidden payload.
Mechanism
getTargets chooses a home skills directory and copyRecursiveSync copies the selected skill files into it.
AI rationale
The installer is an explicit user command that writes skill files into foreign agent skill directories, including a default home .agents/skills target, so it matches explicit user-command agent setup rather than a silent install hook. No preinstall, install, or postinstall script runs that copy, and the handoff path uses ignore-scripts plus dry-run.
Evidence
tools/bin/install.js.agents/skills.cursor/skills.claude/skills
Network endpoints2
github.com/sickn33/agentic-awesome-skills.gitregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package bin agentic-awesome-skills points at tools/bin/install.js, so running the published command executes the installer.
- If no agent flag is passed, getTargets still selects the user home .agents/skills directory.
- Flags such as --cursor and --claude select that agent's skills directory under the user home.
- copyRecursiveSync writes selected skill files into the chosen directory with fs.cpSync.
Evidence against
- package.json scripts contain maintainer commands only and define no preinstall, install, or postinstall hook.
- The installer runs only when the user invokes the bin; npm install does not call it.
- installation-handoff.js builds npm exec with --ignore-scripts and ends the generated command in --dry-run.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
10 flagged · loading sourceskills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
High
High Secret
Package contains a high-severity secret pattern.
skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
High
Secret Pattern
Stripe test secret key in skills/developer-signup-flow/SKILL.md
skills/developer-signup-flow/SKILL.mdView on unpkg · L165tools/bin/aas.jsView file
3L4: const { main } = require("../lib/aas-v1/cli/main");
L5:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
tools/bin/aas.jsView on unpkg · L3Findings
1 Critical6 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationskills/apify-content-analytics/reference/scripts/run_actor.js
HighHigh Secretskills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationskills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirskills/fedora-hyprland-installer/tests/test-scripts.sh
HighSemantic Analysis Limitednode_modules/ajv/dist/runtime/parseJson.js#virtual:normalized:round1
HighSecret Patternskills/developer-signup-flow/SKILL.md
MediumDynamic Requiretools/bin/aas.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helper
Affected versions and remediation
This report applies to agentic-awesome-skills@18.2.0.
See all versions of agentic-awesome-skills for other recorded verdicts.
- Review the evidence and your use of agentic-awesome-skills@18.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.