dksk@1.1.2
The open agent skills ecosystem
AI Security Review
scanned 10h ago · by lpm-firewall-aiThe package has no install hook or confirmed reverse shell, but its runtime telemetry sends search queries and installation details without disclosure in the README. The opt-out does not change that undisclosed default, so this is suspicious telemetry rather than a blockable attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running CLI search or installation commands.
Impact
The telemetry service receives user search terms and skill source and installation details; no credential exfiltration was identified.
Mechanism
The CLI sends search queries and installation metadata to its telemetry endpoint by default, with an environment-variable opt-out.
AI rationale
The package has no install hook or confirmed reverse shell, but its runtime telemetry sends search queries and installation details without disclosure in the README. The opt-out does not change that undisclosed default, so this is suspicious telemetry rather than a blockable attack.
Evidence
dist/cli.mjs
Network endpoints1
add-skill.vercel.sh/t
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends runtime telemetry to https://add-skill.vercel.sh/t and supports disabling it with DISABLE_TELEMETRY or DO_NOT_TRACK.
- A user-run search command includes the search query in its telemetry event.
- A user-run installation may report the source, skill names, agent names, and skill file paths; known-private sources are skipped, but unknown privacy status is not.
- The telemetry runs from explicit CLI commands; the manifest has no install lifecycle hook.
Evidence against
- The package documents browser authentication and direct key entry for its Acore service; the reviewed credential flow uses that service for skill operations.
- The flagged local server is a loopback browser-auth callback, and the GitHub token is sent to api.github.com.
- No concrete reverse shell, credential theft, or unrelated install-time behavior was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
8 flaggeddist/_chunks/libs/simple-git.mjsView file
3import { t as require_dist$1 } from "./@kwsites/promise-deferred.mjs";
L4: import { spawn } from "child_process";
L5: import { Buffer as Buffer$1 } from "node:buffer";
High
Child Process
Package source references child process execution.
dist/_chunks/libs/simple-git.mjsView on unpkg · L3dist/cli.mjsView file
9import { t as require_dist } from "./_chunks/libs/@vercel/detect-agent.mjs";
L10: import { execSync, spawnSync } from "child_process";
L11: import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
...
L20: import { createHash } from "crypto";
L21: import { createServer } from "http";
L22: import { strFromU8, unzipSync, zipSync } from "fflate";
L23: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
...
L48: }
L49: async function isRepoPrivate(owner, repo) {
L50: try {
...
L267: function countVisualRowsForLines(lines, columns) {
L268: const cols = columns !== void 0 && columns > 0 ? columns : process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/cli.mjsView on unpkg · L9Findings
3 Critical5 High4 Medium4 Low
CriticalReverse Shelldist/cli.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli.mjs
CriticalPrevious Version Dangerous Deltadist/cli.mjs
HighChild Processdist/_chunks/libs/simple-git.mjs
HighShelldist/cli.mjs
HighSandbox Evasion Gated Capabilitydist/cli.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.mjs
HighCross File Remote Execution Contextdist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
Affected versions and remediation
This report applies to dksk@1.1.2.
See all versions of dksk for other recorded verdicts.
- Review the evidence and your use of dksk@1.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.