registry / happyskills / 2.2.0
happyskills@2.2.0
⚠ Under reviewPackage manager for AI agent skills
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedsrc/integration/drift.test.jsView file
27const assert = require('node:assert/strict')
L28: const { spawnSync } = require('child_process')
L29: const fs = require('fs')
High
Child Process
Package source references child process execution.
src/integration/drift.test.jsView on unpkg · L27bin/happyskills.jsView file
2L3: try { require('dotenv').config({ path: require('path').join(__dirname, '..', '.env'), quiet: true }) } catch {}
L4: const { run } = require('../src/index')
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/happyskills.jsView on unpkg · L2src/commands/self-update.jsView file
35
Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltasrc/integration/skill_drift_nudge.test.js
HighChild Processsrc/integration/drift.test.js
HighRuntime Package Installsrc/commands/self-update.js
MediumDynamic Requirebin/happyskills.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to happyskills@2.2.0.
See all versions of happyskills for other recorded verdicts.
- Review the evidence and your use of happyskills@2.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.