happyskills@1.17.0
Package manager for AI agent skills
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection shows a user-invoked AI-skill package manager with broad agent integration, not lifecycle-triggered hijacking or malware. Because it can install registry content into AI-agent control surfaces, warn rather than block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User-invoked happyskills CLI commands such as install, setup, agents, self-update, or login
Impact
User-selected registry skills may become visible to configured AI agents; no unconsented lifecycle mutation was found.
Mechanism
package-aligned AI skill installation and agent-directory linking
AI rationale
Static source inspection shows a user-invoked AI-skill package manager with broad agent integration, not lifecycle-triggered hijacking or malware. Because it can install registry content into AI-agent control surfaces, warn rather than block.
Evidence
package.jsonbin/happyskills.jssrc/index.jssrc/engine/installer.jssrc/agents/registry.jssrc/agents/detector.jssrc/agents/linker.jssrc/commands/setup.jssrc/commands/self-update.jssrc/api/client.jssrc/utils/scrub_secrets.test.js.agents/skills/skills-lock.jsonskills-config.json.claude/skills/.cursor/skills/.codex/skills/~/.config/happyskills/credentials.json
Network endpoints2
api.happyskills.airegistry.npmjs.org/happyskills/latest
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- src/engine/installer.js downloads registry skills and links them into agent skill directories.
- src/agents/registry.js targets broad AI-agent surfaces including .claude/skills, .cursor/skills, and .codex/skills.
- src/agents/detector.js defaults to Claude Code when no agent is configured, but only during user-invoked commands.
- src/commands/setup.js installs happyskillsai/happyskills into agent skills on explicit setup.
- src/commands/self-update.js can run npm install -g happyskills@latest only when self-update is invoked.
Evidence against
- package.json has no preinstall/postinstall/prepare lifecycle scripts.
- bin/happyskills.js only loads dotenv from the package .env and dispatches CLI args.
- src/index.js command loading is constrained by a fixed COMMANDS allowlist.
- Network traffic is package-aligned to https://api.happyskills.ai and npm registry update checks.
- Secret-looking strings in src/utils/scrub_secrets.test.js are synthetic redaction fixtures.
- No evidence of credential harvesting, persistence hooks, destructive behavior, eval, or install-time agent mutation.
Behavioral surface
Source & flagged code
6 flaggedsrc/utils/scrub_secrets.test.jsView file
16patternName = aws_access_key
severity = critical
line = 16
matchedText = assert.e...}.`)
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/utils/scrub_secrets.test.jsView on unpkg · L1616patternName = aws_access_key
severity = critical
line = 16
matchedText = assert.e...}.`)
Critical
Secret Pattern
AWS access key ID in src/utils/scrub_secrets.test.js
src/utils/scrub_secrets.test.jsView on unpkg · L16src/integration/drift.test.jsView file
27const assert = require('node:assert/strict')
L28: const { spawnSync } = require('child_process')
L29: const fs = require('fs')
High
Child Process
Package source references child process execution.
Findings
3 Critical3 High3 Medium5 Low
CriticalCritical Secretsrc/utils/scrub_secrets.test.js
CriticalPrevious Version Dangerous Deltasrc/integration/install_dep_closure.test.js
CriticalSecret Patternsrc/utils/scrub_secrets.test.js
HighChild Processsrc/integration/drift.test.js
HighSame File Env Network Executionsrc/integration/api_envelope.test.js
HighRuntime Package Installsrc/commands/self-update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to happyskills@1.17.0.
See all versions of happyskills for other recorded verdicts.
- Review the evidence and your use of happyskills@1.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.