dksk@1.1.1
The open agent skills ecosystem
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a user-run fork of the vercel-labs skills CLI that installs skill folders and talks to Giikin Acore APIs. Scanner reverse-shell, shell, and agent-control hits are the localhost login helper, git child_process usage, and intended skill-directory writes, with no install-time hook.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the dksk command, for example add, update, or auth.
Impact
No unconsented attack is established; skill install happens only after an explicit command.
Mechanism
User-invoked CLI that installs skill files into agent skill folders.
AI rationale
This is a user-run fork of the vercel-labs skills CLI that installs skill folders and talks to Giikin Acore APIs. Scanner reverse-shell, shell, and agent-control hits are the localhost login helper, git child_process usage, and intended skill-directory writes, with no install-time hook.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a dksk CLI binary and has no install-time lifecycle scripts.
- Browser login starts a localhost HTTP server and opens a URL, which scanners can label a reverse shell.
- The add and update commands write skill files into many AI agent skill folders after path-safety checks.
- child_process is used for git clone, GitHub CLI token lookup, and re-running this CLI.
- CI and tracking environment variables only gate anonymous telemetry.
Evidence against
- There are no preinstall, install, or postinstall scripts; nothing runs on npm install.
- Source is a vercel-labs skills CLI fork plus a company skill marketplace on Giikin Acore APIs, all user-invoked.
- No eval, obfuscation, secret harvesting, or install-time agent-config mutation is present.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/_chunks/libs/simple-git.mjsView file
3import { t as require_dist$1 } from "./@kwsites/promise-deferred.mjs";
L4: import { spawn } from "child_process";
L5: import { Buffer as Buffer$1 } from "node:buffer";
High
Child Process
Package source references child process execution.
dist/_chunks/libs/simple-git.mjsView on unpkg · L3dist/cli.mjsView file
9import { t as require_dist } from "./_chunks/libs/@vercel/detect-agent.mjs";
L10: import { execSync, spawnSync } from "child_process";
L11: import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
...
L20: import { createHash } from "crypto";
L21: import { createServer } from "http";
L22: import { strFromU8, unzipSync, zipSync } from "fflate";
L23: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
...
L48: }
L49: async function isRepoPrivate(owner, repo) {
L50: try {
...
L267: function countVisualRowsForLines(lines, columns) {
L268: const cols = columns !== void 0 && columns > 0 ? columns : process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/cli.mjsView on unpkg · L9Findings
2 Critical5 High4 Medium4 Low
CriticalReverse Shelldist/cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli.mjs
HighChild Processdist/_chunks/libs/simple-git.mjs
HighShelldist/cli.mjs
HighSandbox Evasion Gated Capabilitydist/cli.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.mjs
HighCross File Remote Execution Contextdist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dksk@1.1.1.
See all versions of dksk for other recorded verdicts.
- Review the evidence and your use of dksk@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.