registry / AI-agent control-surface risk / ani-skills

ani-skills

ANI-Skills Ultra is a comprehensive AI Agent Skills library with 3,048+ skills across 29 semantic namespaces for Antigravity, Claude Code, Cursor, Windsurf, Copilot, Codex, Gemini CLI, and OpenCode, featuring an interactive GUI installer.

This report shows the evidence for ani-skills@2.1.0. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic postinstall path broadly modifies foreign project and user-global AI-agent skill directories, including destructive replacement of existing directories. This meets the install-control-surface blocking policy.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

It changes multiple foreign AI-agent control surfaces without an explicit user command or agent selection.

Mechanism

Automatic broad AI-agent skill installation and directory replacement

Policy narrative

npm runs bin/install.js with --auto during postinstall. The installer enumerates installed AI agents and, for each detected one, installs all skills to both the current project's agent directory and the user's global agent directory. Where linking is enabled, it force-removes an existing target skill directory and replaces it with a symlink to this package. This is an unconsented, broad mutation of third-party AI-agent control surfaces.

AI rationale

Evidence

package.jsonbin/install.js.claude/skills.cursor/skills.windsurf/skills.github/skills.agents/skills.gemini/skills.opencode/skills

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs its installer after npm installation.
The installer detects several unrelated AI-agent installations and targets both consumer-project and user-global skill directories.
Automatic mode installs the complete skill set for every detected agent without user selection.
The installer can recursively delete existing agent skill directories before replacing them with a symlink.

Evidence against

No runtime dependency on another ani-skills release is declared.
The inspected installer contains no external network request or credential exfiltration path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 806 file(s), 5.93 MB of source, external domains: 127.0.0.1, abs.twimg.com, accounts.google.com, agent-media.ai, antigravity.google, api.browserbase.com, api.dicebear.com, api.example.com, api.maptiler.com, api.minimax.io, api.minimaxi.com, api.openai.com, api.postiz.com, api.replicate.com, api.stripe.com, api.telegram.org, api.typefully.com, api.weixin.qq.com, api.z.ai, app.taisly.com, ark.cn-beijing.volces.com, browserbase.com, card.weibo.com, cdn.example.com, cdn.jsdelivr.net, cdn.syndication.twimg.com, cdn.tailwindcss.com, cesium.com, challenges.cloudflare.com, cli-auth.postiz.com, cloud.maptiler.com, consent.youtube.com, console.anthropic.com, console.volcengine.com, content-push.googleapis.com, crates.io, cursor.com, dashscope.aliyuncs.com, defuddle.md, developers.cloudflare.com, developers.google.com, developers.openai.com, docs.anthropic.com, docs.github.com, docs.windsurf.com, docs.z.ai, example.com, example.io, example.openai.azure.com, example.org

Source & flagged code

27 flagged

package.jsonView file

Lines 1-32json

2 "name": "ani-skills",

3 "version": "2.1.0",

4 "description": "ANI-Skills Ultra is a comprehensive AI Agent Skills library with 3,048+ skills across 29 semantic namespaces for Antigravity, Claude Code, Cursor, Windsurf, Copilot, Codex, Gemini CLI, and OpenCode, featuring an interactive GUI installer.",

5 "main": "skills_index.json",

6 "bin": {

7 "ani-skills": "./bin/install.js"

8 },

9 "scripts": {

10 "build:index": "python scripts/update_skills_index.py",

11 "lint:skills": "python scripts/verify_stats.py",

12 "postinstall": "node bin/install.js --auto"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "keywords": [

15 "skills",

16 "agent",

17 "antigravity",

18 "claude-code",

19 "workflows",

20 "gsap",

21 "scrolltrigger",

22 "marketing",

23 "seo",

24 "security",

25 "cursor",

26 "cursorrules",

27 "windsurfrules",

28 "ai-agents",

29 "agent-skills",

30 "developer-prompts",

31 "automation",

32 "threejs",

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView file

Lines 2-42markdown

3Detailed vulnerability patterns, exploitation techniques, and audit checklists for Firebase implementations in mobile applications.

5---

7## 1. OPEN EMAIL/PASSWORD SIGNUP (Critical)

9**The Problem:** Firebase Authentication allows anyone to create accounts via the Identity Toolkit API, even if the app UI doesn't expose registration.

11**Vulnerable Configuration:**

12```

13Firebase Console → Authentication → Sign-in method → Email/Password: Enabled

14```

16**Exploitation:**

17```bash

18# Create arbitrary account via API

19curl -X POST \

20 -H "Content-Type: application/json" \

21 -d '{"email":"attacker@evil.com","password":"Password123!","returnSecureToken":true}' \

22 "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

High

High Secret

Package contains a high-severity secret pattern.

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

23```

25**Successful Attack Response:**

26```json

27{

28 "idToken": "eyJhbGciOiJSUzI1NiIs...",

29 "email": "attacker@evil.com",

30 "refreshToken": "AGEhc0C...",

31 "expiresIn": "3600",

32 "localId": "abc123xyz"

33}

34```

36**Impact:**

37- Bypass invite-only systems

38- Access authenticated-only resources

39- Exhaust authentication quotas

40- Potential for account enumeration attacks

42**Secure Configuration:**

22patternName = google_api_key severity = high line = 22

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

596patternName = google_api_key severity = high line = 596

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L596

742patternName = google_api_key severity = high line = 742

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L742

bin/install.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * ANI-Skills Ultra Package Installer v2.0

4 * ========================================

5 * High-performance, multi-agent installer featuring:

6 * - Interactive Monochromatic Web GUI Popup with category checkboxes

7 * - Interactive TUI Terminal fallback

8 * - Full support for all 8 AI Coding Agents (Project & Global paths)

9 * - 3,028 Skills across 29 Semantic Namespaces

10 */

12const fs = require('fs');

13const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/install.jsView on unpkg · L11

14const http = require('http');

15const os = require('os');

16const { exec, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L15

18const projectRoot = path.dirname(__dirname);

19const skillsSrc = path.join(projectRoot, 'skills');

20const geminiCmdSrc = path.join(projectRoot, '.gemini', 'commands');

21const homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir();

22const cwd = process.cwd();

24// ─── AGENT DEFINITIONS ────────────────────────────────────────────────────────

25function getAgents() {

26 return [

27 {

28 id: 'antigravity',

29 name: 'Antigravity IDE',

30 trigger: path.join(homeDir, '.gemini', 'config'),

31 projectPath: path.join(cwd, '.agents', 'skills'),

32 globalPath: path.join(homeDir, '.gemini', 'config', 'skills'),

33 commandsGlobal: [

34 path.join(homeDir, '.gemini', 'commands'),

35 path.join(homeDir, '.gemini', 'config', 'commands'),

30trigger: path.join(homeDir, '.gemini', 'config'), L31: projectPath: path.join(cwd, '.agents', 'skills'), L32: globalPath: path.join(homeDir, '.gemini', 'config', 'skills'), ... L41: name: 'Claude Code', L42: trigger: path.join(homeDir, '.claude'), L43: projectPath: path.join(cwd, '.claude', 'skills'), L44: globalPath: path.join(homeDir, '.claude', 'skills'), L45: docs: 'https://docs.anthropic.com/en/docs/claude-code/skills', ... L73: name: 'Codex (OpenAI)', L74: trigger: path.join(homeDir, '.agents'), L75: projectPath: path.join(cwd, '.agents', 'skills'), L76: globalPath: path.join(homeDir, '.agents', 'skills'),

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L30

13const path = require('path'); L14: const http = require('http'); L15: const os = require('os'); L16: const { exec, execSync } = require('child_process'); L17: ... L20: const geminiCmdSrc = path.join(projectRoot, '.gemini', 'commands'); L21: const homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir(); L22: const cwd = process.cwd();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/install.jsView on unpkg · L13

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. unt = count; } } if (mode === 'global' || mode === 'both') { if (isall && shouldlink()) { try { const type = process.platform === 'win32' ? 'junction' : 'dir'; if (fs.existssync(agent.globalpath)) fs.rmsync(agent.globalpath, { recursive: true, force: true }); fs.mkdirsync(path.dirname(agent.globalpath), { recursive: true }); fs.symlinksync(skillssrc, agent.globalpath, type); results.paths.push(`${agent.globalpath} (symlinked all)`); } catch (_) { copyrecursivefiltered(skillssrc, agent.globalpath, selectedcategories); results.paths.push(agent.globalpath); } } else { copyrecursivefilte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView file

Lines 109-149typescript

109 return true;

110 }

111 if (i < retries - 1) {

112 console.error(`[paste] Attempt ${i + 1}/${retries} failed, retrying in ${delayMs}ms...`);

113 sleepSync(delayMs);

114 }

115 }

116 return false;

117 }

118

119 console.error('[paste] No supported tool found. Install xdotool (X11) or ydotool (Wayland).');

120 return false;

121}

122

123function pasteWindows(retries: number, delayMs: number): boolean {

124 const ps = `

125 Add-Type -AssemblyName System.Windows.Forms

126 [System.Windows.Forms.SendKeys]::SendWait("^v")

127 `;

128

129 for (let i = 0; i < retries; i++) {

130 const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' });

131 if (result.status === 0) {

High

Shell

Package source references shell execution.

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView on unpkg · L129

132 return true;

133 }

134 if (i < retries - 1) {

135 console.error(`[paste] Attempt ${i + 1}/${retries} failed, retrying in ${delayMs}ms...`);

136 sleepSync(delayMs);

137 }

138 }

139 return false;

140}

141

142function paste(retries: number, delayMs: number, targetApp?: string): boolean {

143 switch (process.platform) {

144 case 'darwin':

145 return pasteMac(retries, delayMs, targetApp);

146 case 'linux':

147 return pasteLinux(retries, delayMs);

148 case 'win32':

149 return pasteWindows(retries, delayMs);

skills/skills-webmcp-gen/scripts/compile.mjsView file

Lines 137-177javascript

137 success: true,

138 registeredTools: WEBMCP_GEN_TOOLS.map((tool) => tool.name),

139 };

140 }

141

142 window.__webmcpGenRegistration = registerTools();

143})();

144`;

145}

146

147function staticChecks(manifest, source) {

148 const warnings = [];

149 const errors = [];

150 if (!source.includes("navigator.modelContext.registerTool")) {

151 errors.push("Generated script does not register WebMCP tools.");

152 }

153 for (const tool of manifest.tools) {

154 const implementationSource = String(tool.implementation.source || "");

155 if (PLAYWRIGHT_STYLE_PATTERNS.some((pattern) => pattern.test(implementationSource))) {

156 warnings.push(`Tool "${tool.name}" may contain Playwright-style code; WebMCP implementations run in the page.`);

157 }

158 if (implementationSource.includes("eval(") || implementationSource.includes("new Function")) {

159 errors.push(`Tool "${tool.name}" uses eval/new Function.`);

High

Eval

Package source references dynamic code evaluation.

skills/skills-webmcp-gen/scripts/compile.mjsView on unpkg · L157

160 }

161 }

162 return { passed: errors.length === 0, errors, warnings };

163}

164

165async function main() {

166 const artifactDir = process.argv[2];

167 if (!artifactDir) throw new Error(usage());

168

169 const resolvedArtifactDir = path.resolve(process.cwd(), artifactDir);

170 const manifestPath = path.join(resolvedArtifactDir, "manifest.json");

171 const manifest = JSON.parse(await readFile(manifestPath, "utf8"));

172 const source = emitWebMCPInitScript(manifest);

173 const checks = staticChecks(manifest, source);

174 if (!checks.passed) {

175 throw new Error(`Static checks failed:\n${checks.errors.map((error) => `- ${error}`).join("\n")}`);

176 }

177 await writeFile(path.join(resolvedArtifactDir, "webmcp.init.js"), source, "utf8");

skills/skills-browser-to-api/scripts/infer.mjsView file

Lines 78-118javascript

78 responseSchemas[String(status)] = toSchema(p);

79 }

81 // Determine the canonical content-type per role from sample headers.

82 const reqCT = inferContentType(samples, 'reqHeaders');

83 const respCTByStatus = {};

84 for (const s of samples) {

85 const status = s.status ?? 0;

86 if (!respCTByStatus[status]) respCTByStatus[status] = inferContentType([s], 'respHeaders');

87 }

89 // Redact once and reuse for both the persisted sample file and the inline

90 // OpenAPI example. (Calling redactBody twice double-counts redactions.)

91 const ph = pathHash(ep.method, ep.path);

92 const reqExample = pickedReqExample != null ? redactor.redactBody(pickedReqExample) : null;

93 const respExample = pickedRespExample != null ? redactor.redactBody(pickedRespExample) : null;

94 const reqHeaders = redactor.redactHeaders(samples[0]?.reqHeaders || {});

95 const respHeaders = redactor.redactHeaders(samples[0]?.respHeaders || {});

97 const example = {

98 endpoint: ep.endpointKey,

99 request: { status: pickedReqStatus, headers: reqHeaders, body: reqExample },

100 response: { status: pickedRespStatus, headers: respHeaders, body: respExample },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/skills-browser-to-api/scripts/infer.mjsView on unpkg · L98

101 };

102 writeJson(samplePath(outDir, ep.method, ph), example);

103

104 enriched.push({

105 ...ep,

106 pathHash: ph,

107 requestBodyKnown,

108 responseBodyKnown,

109 requestSchema,

110 responseSchemas,

111 requestContentType: reqCT,

112 responseContentTypes: respCTByStatus,

113 requestExample: reqExample,

114 responseExample: respExample,

115 observedAuthHeaders: inferAuthHeaders(samples),

116 });

117 }

118

skills/gstack-browse/src/cookie-import-browser.tsView file

196if (fs.existsSync(prefsPath)) { L197: const prefs = JSON.parse(fs.readFileSync(prefsPath, 'utf-8')); L198: const email = prefs?.account_info?.[0]?.email; ... L319: function getHostPlatform(): BrowserPlatform | null { L320: const p = process.platform; L321: if (p === 'darwin' || p === 'linux' || p === 'win32') return p as BrowserPlatform; ... L341: function getBaseDir(platform: BrowserPlatform): string { L342: if (platform === 'darwin') return path.join(os.homedir(), 'Library', 'Application Support'); L343: if (platform === 'win32') return path.join(os.homedir(), 'AppData', 'Local'); ... L527: L528: const proc = Bun.spawn(['powershell', '-NoProfile', '-Command', script], { L529: windowsHide: true,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

skills/gstack-browse/src/cookie-import-browser.tsView on unpkg · L196

skills/gstack-browse/src/cli.tsView file

8* 4. Send command via HTTP POST L9: * 5. Print response to stdout (or stderr for errors) L10: */ ... L13: import * as path from 'path'; L14: import { spawn as nodeSpawn } from 'child_process'; L15: import { safeUnlink, safeUnlinkQuiet, safeKill, isProcessAlive } from './error-handling'; ... L25: const config = resolveConfig(); L26: const IS_WINDOWS = process.platform === 'win32'; L27: ... L40: */ L41: export function resolveStartTimeout(env: NodeJS.ProcessEnv = process.env): number { L42: // Cold Chromium launch measured ~5.7s at load avg 10 on a dev machine running

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

skills/gstack-browse/src/cli.tsView on unpkg · L8

skills/postiz-agent-postiz/src/commands/auth.tsView file

5L6: const CREDENTIALS_DIR = join(homedir(), '.postiz'); L7: const CREDENTIALS_FILE = join(CREDENTIALS_DIR, 'credentials.json'); L8: L9: const DEFAULT_AUTH_SERVER = 'https://cli-auth.postiz.com'; L10: ... L19: if (!existsSync(CREDENTIALS_FILE)) return null; L20: const data = JSON.parse(readFileSync(CREDENTIALS_FILE, 'utf-8')); L21: if (!data.accessToken) return null; ... L43: function openBrowser(url: string): void { L44: const { exec } = require('child_process'); L45: const platform = process.platform;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

skills/postiz-agent-postiz/src/commands/auth.tsView on unpkg · L5

skills/humanizer-ru/demo/markers.jsView file

206contains invisible/control Unicode U+202A (left-to-right embedding) "source": "[<U+200B><U+200C><U+200E><U+200F><U+202A>-<U+202E><U+2060>-⁤<U+2066>-<U+2069><U+FEFF>￹-￻]|(?<![🀀-🫿☀-➿️🇦-🇿])<U+200D>(?![🀀-🫿☀-➿️🇦-🇿])",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

skills/humanizer-ru/demo/markers.jsView on unpkg · L206

skills/playwright-skill/templates/lambdatest-setup.tsView file

13* Run: L14: * npx playwright test --project=chromium # local L15: * npx playwright test --project="chrome:latest:Windows 11@lambdatest" # cloud ... L19: import { chromium } from 'playwright'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/playwright-skill/templates/lambdatest-setup.tsView on unpkg · L13

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView file

•path = skills/sk[redacted]/scripts/calculate_cost.py kind = build_helper sizeBytes = 12190 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView file

•path = skills/sk[redacted]/tests/test_run_mr_brain_finetune.py kind = payload_in_excluded_dir sizeBytes = 6761 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView on unpkg

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView on unpkg

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L41

96patternName = generic_password severity = medium line = 96

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L96

skills/skills-firebase-apk-scanner/scanner.shView file

524patternName = generic_password severity = medium line = 524

Medium

Secret Pattern

Hardcoded password in skills/skills-firebase-apk-scanner/scanner.sh

skills/skills-firebase-apk-scanner/scanner.shView on unpkg · L524

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --auto

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.js --auto

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView file

22patternName = google_api_key severity = high line = 22

High

High Secret

Package contains a high-severity secret pattern.

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

22patternName = google_api_key severity = high line = 22

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

596patternName = google_api_key severity = high line = 596

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L596

742patternName = google_api_key severity = high line = 742

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L742

bin/install.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L30

15const os = require('os'); L16: const { exec, execSync } = require('child_process'); L17:

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L15

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/install.jsView on unpkg · L13

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

11L12: const fs = require('fs'); L13: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/install.jsView on unpkg · L11

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView file

129for (let i = 0; i < retries; i++) { L130: const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' }); L131: if (result.status === 0) {

High

Shell

Package source references shell execution.

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView on unpkg · L129

skills/skills-webmcp-gen/scripts/compile.mjsView file

157} L158: if (implementationSource.includes("eval(") || implementationSource.includes("new Function")) { L159: errors.push(`Tool "${tool.name}" uses eval/new Function.`);

High

Eval

Package source references dynamic code evaluation.

skills/skills-webmcp-gen/scripts/compile.mjsView on unpkg · L157

skills/skills-browser-to-api/scripts/infer.mjsView file

98endpoint: ep.endpointKey, L99: request: { status: pickedReqStatus, headers: reqHeaders, body: reqExample }, L100: response: { status: pickedRespStatus, headers: respHeaders, body: respExample },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/skills-browser-to-api/scripts/infer.mjsView on unpkg · L98

skills/gstack-browse/src/cookie-import-browser.tsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

skills/gstack-browse/src/cookie-import-browser.tsView on unpkg · L196

skills/gstack-browse/src/cli.tsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

skills/gstack-browse/src/cli.tsView on unpkg · L8

skills/postiz-agent-postiz/src/commands/auth.tsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

skills/postiz-agent-postiz/src/commands/auth.tsView on unpkg · L5

skills/humanizer-ru/demo/markers.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

skills/humanizer-ru/demo/markers.jsView on unpkg · L206

skills/playwright-skill/templates/lambdatest-setup.tsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/playwright-skill/templates/lambdatest-setup.tsView on unpkg · L13

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView file

•path = skills/sk[redacted]/scripts/calculate_cost.py kind = build_helper sizeBytes = 12190 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView file

•path = skills/sk[redacted]/tests/test_run_mr_brain_finetune.py kind = payload_in_excluded_dir sizeBytes = 6761 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView on unpkg

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView on unpkg

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L41

96patternName = generic_password severity = medium line = 96

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L96

skills/skills-firebase-apk-scanner/scanner.shView file

524patternName = generic_password severity = medium line = 524

Medium

Secret Pattern

Hardcoded password in skills/skills-firebase-apk-scanner/scanner.sh

skills/skills-firebase-apk-scanner/scanner.shView on unpkg · L524

Findings

3 Critical16 High10 Medium5 Low

CriticalCredential Exfiltrationskills/gstack-browse/src/cookie-import-browser.ts

CriticalAi Agent Control Hijackbin/install.js

CriticalTrojan Source Unicodeskills/humanizer-ru/demo/markers.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretskills/skills-firebase-apk-scanner/references/vulnerabilities.md

HighChild Processbin/install.js

HighShellskills/baoyu-post-to-weibo/scripts/paste-from-clipboard.ts

HighEvalskills/skills-webmcp-gen/scripts/compile.mjs

HighSame File Env Network Executionbin/install.js

HighCommand Output Exfiltrationskills/gstack-browse/src/cli.ts

HighSandbox Evasion Gated Capabilityskills/postiz-agent-postiz/src/commands/auth.ts

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js

HighRuntime Package Installskills/playwright-skill/templates/lambdatest-setup.ts

HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf

HighPayload In Excluded Dirskills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.py

HighSemantic Analysis Limitedskills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjs

HighSecret Patternskills/skills-firebase-apk-scanner/references/vulnerabilities.md

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/install.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/skills-agent-platform-tuning/scripts/calculate_cost.py

MediumShips Compressed Blobskills/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

MediumSecret Patternskills/skills-firebase-apk-scanner/scanner.sh

LowScripts Present

LowWeak Cryptoskills/skills-browser-to-api/scripts/infer.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to ani-skills@2.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing ani-skills@2.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-01 01:56:42.461Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

2.1.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 30, 2026, 6:43 PM 1.0.1Suspicious—WarnUnder ReviewJul 10, 2026, 9:54 AM

98%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

AuthorZain Ali Mughal

Version2.1.0

PublishedAug 30, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size47.4 MB

Files26,079

Keywordsskillsagentantigravityclaude-codeworkflowsgsapscrolltriggermarketing

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → skills_index.jsonbin → ani-skills

RuntimeNo engine / OS / CPU constraints

Artifact162 MB · 26,079 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedPossibleObfuscationUrlStringsManifest: clean

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Source & flagged code

Related packages

Other AI-agent control-surface risk packages