happyskills@3.4.0
Package manager for AI agent skills
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package sends raw search queries as telemetry to its own API during search and reranking flows, without an evident consent prompt or opt-out. The reviewed flow does not show credential or file exfiltration, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a search that produces reranking or clarification telemetry; postlex also emits query telemetry.
Impact
Queries may contain sensitive user-provided text and are reported to the service without an evident consent prompt or opt-out.
Mechanism
The command passes the query in a telemetry payload, which is POSTed to the configured API base at /telemetry/discovery.
AI rationale
The package sends raw search queries as telemetry to its own API during search and reranking flows, without an evident consent prompt or opt-out. The reviewed flow does not show credential or file exfiltration, so this warrants a warning rather than a block.
Evidence
src/commands/search.jssrc/commands/postlex.jssrc/api/telemetry.js
Network endpoints2
api.happyskills.ai/telemetry/discoveryHAPPYSKILLS_API_URL/telemetry/discovery
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Search telemetry includes the user's raw query when reranking or clarification events occur.
- The telemetry function POSTs its payload to the package's API endpoint without a visible consent or opt-out check.
- The endpoint defaults to the HappySkills API and can be overridden through HAPPYSKILLS_API_URL.
Evidence against
- The telemetry is triggered by search or reranking activity, not by install or package import alone.
- The flagged local app accepts requests only through its loopback host and uses a token check.
- The reviewed code did not show credentials, file contents, or tool output being sent in this telemetry flow.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedsrc/local_app/kernel.test.jsView file
8const http = require('node:http')
L9: const { spawn } = require('node:child_process')
L10: const { CLI_VERSION } = require('../constants')
High
Child Process
Package source references child process execution.
src/local_app/kernel.test.jsView on unpkg · L8src/commands/self-update.jsView file
35L36: const run_npm_install = () => catch_errors('npm install failed', async () => {
L37: const { spawn } = require('child_process')
L38: const stdio = is_json_mode() ? 'pipe' : 'inherit'
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/commands/self-update.jsView on unpkg · L35package.jsonView file
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltasrc/commands/app.js
HighChild Processsrc/local_app/kernel.test.js
HighRuntime Package Installsrc/commands/self-update.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to happyskills@3.4.0.
See all versions of happyskills for other recorded verdicts.
- Review the evidence and your use of happyskills@3.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.