happyskills@3.1.0
Package manager for AI agent skills
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source shows default runtime telemetry sent to the package's own API, including a persistent random device ID, without a clear opt-out. This supports a warning for undisclosed telemetry; the reviewed flow does not establish credential theft or another malicious action.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI invocations record events; buffered events are uploaded at the start of a later network-backed command or when the buffer reaches its delivery threshold.
Impact
HappySkills can correlate command usage over time for a device. The reviewed telemetry path did not show credential or file-content collection.
Mechanism
Command metadata and an opaque persistent device identifier are buffered locally, then sent in authenticated POST requests to the package's API.
AI rationale
The source shows default runtime telemetry sent to the package's own API, including a persistent random device ID, without a clear opt-out. This supports a warning for undisclosed telemetry; the reviewed flow does not establish credential theft or another malicious action.
Evidence
src/index.jssrc/utils/command_telemetry.jssrc/utils/analytics.jssrc/utils/device.jssrc/commands/config.jsconfig_dir()/events-buffer.ndjsonconfig_dir()/device.json
Network endpoints2
api.happyskills.aiHAPPYSKILLS_API_URL override
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Every CLI invocation starts command telemetry and installs an exit hook.
- The command event records the command name, exit code, duration, CLI version, JSON mode and optional error code.
- Buffered events are sent to the HappySkills API at /events with authentication; the default host is api.happyskills.ai.
- Events include a persistent random device UUID described as an anonymous analytics ID; the CLI offers a reset command but no clear telemetry opt-out.
Evidence against
- The telemetry fields shown do not include command arguments, environment values or file contents.
- The device ID is randomly generated rather than derived from host or hardware attributes.
- The new local app listens on loopback and requires a token for its API.
- The manifest contains no install, preinstall or postinstall hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flaggedsrc/local_app/kernel.test.jsView file
8const http = require('node:http')
L9: const { spawn } = require('node:child_process')
L10: const { CLI_VERSION } = require('../constants')
High
Child Process
Package source references child process execution.
src/local_app/kernel.test.jsView on unpkg · L8src/commands/self-update.jsView file
35L36: const run_npm_install = () => catch_errors('npm install failed', async () => {
L37: const { spawn } = require('child_process')
L38: const stdio = is_json_mode() ? 'pipe' : 'inherit'
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/commands/self-update.jsView on unpkg · L35package.jsonView file
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltasrc/commands/app.js
HighChild Processsrc/local_app/kernel.test.js
HighRuntime Package Installsrc/commands/self-update.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to happyskills@3.1.0.
See all versions of happyskills for other recorded verdicts.
- Review the evidence and your use of happyskills@3.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.