happyskills@1.22.1
Package manager for AI agent skills
AI Security Review
scanned 4mo ago · by lpm-firewall-aiNo concrete malicious behavior, hidden execution, exfiltration, or lifecycle hook was found. The package nevertheless has an explicit user-invoked capability to install remote content into AI-agent control surfaces, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `happyskills install`, `setup`, or `agents add`.
Impact
User-selected remote skill content can become available to AI-agent runtimes.
Mechanism
downloads skills, writes `.agents/skills`, and symlinks/copies them into agent skill folders
AI rationale
No concrete malicious behavior, hidden execution, exfiltration, or lifecycle hook was found. The package nevertheless has an explicit user-invoked capability to install remote content into AI-agent control surfaces, so it warrants a warning rather than a block.
Evidence
package.jsonbin/happyskills.jssrc/index.jssrc/engine/installer.jssrc/agents/detector.jssrc/agents/linker.jssrc/commands/agents.jssrc/engine/archive_installer.js.agents/skills/<skill>.claude/skills/<skill>.cursor/skills/<skill>.codex/skills/<skill>
Network endpoints2
api.happyskills.airegistry.npmjs.org/happyskills/latest
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `install` downloads registry-selected skills and links them into agent skill directories.
- No configured target causes a default Claude Code link after an explicit install.
- `agents add/remove` creates and removes agent-skill links.
Evidence against
- `package.json` has no install lifecycle hooks.
- Entrypoint only dispatches after the user runs the CLI; command names are allowlisted.
- API token use is confined to requests to the configured HappySkills API; secret scrubber redacts feedback context.
- Archive extraction rejects traversal entries and verifies size limits.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggedsrc/utils/scrub_secrets.test.jsView file
16patternName = aws_access_key
severity = critical
line = 16
matchedText = assert.e...}.`)
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/utils/scrub_secrets.test.jsView on unpkg · L1616patternName = aws_access_key
severity = critical
line = 16
matchedText = assert.e...}.`)
Critical
Secret Pattern
AWS access key ID in src/utils/scrub_secrets.test.js
src/utils/scrub_secrets.test.jsView on unpkg · L16src/integration/drift.test.jsView file
27const assert = require('node:assert/strict')
L28: const { spawnSync } = require('child_process')
L29: const fs = require('fs')
High
Child Process
Package source references child process execution.
Findings
3 Critical3 High4 Medium5 Low
CriticalCritical Secretsrc/utils/scrub_secrets.test.js
CriticalPrevious Version Dangerous Deltasrc/integration/skills-config.test.js
CriticalSecret Patternsrc/utils/scrub_secrets.test.js
HighChild Processsrc/integration/drift.test.js
HighSame File Env Network Executionsrc/integration/api_envelope.test.js
HighRuntime Package Installsrc/commands/self-update.js
MediumDynamic Requirebin/happyskills.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to happyskills@1.22.1.
See all versions of happyskills for other recorded verdicts.
- Review the evidence and your use of happyskills@1.22.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.