registry / happyskills / 4.3.0
happyskills@4.3.0
⚠ Under reviewPackage manager for AI agent skills
Static Scan Results
scanned 11d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedbin/happyskills.jsView file
2L3: try { require('dotenv').config({ path: require('path').join(__dirname, '..', '.env'), quiet: true }) } catch {}
L4: const { run } = require('../src/index')
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/happyskills.jsView on unpkg · L2src/engine/cli_install.jsView file
3const path = require('path')
L4: const { spawn } = require('child_process')
L5: const { CliError } = require('../utils/errors')
...
L15:
L16: const NPM_REGISTRY_URL = process.env.HAPPYSKILLS_NPM_REGISTRY_URL || 'https://registry.npmjs.org/happyskills/latest'
L17: const PACKAGE_NAME = 'happyskills'
...
L20: // On Windows `npm` is a .cmd shim; Node spawns those only through a shell.
L21: const npm_spawn_opts = (extra) => ({ ...extra, shell: process.platform === 'win32' })
L22:
...
L34: }, timeout_ms)
L35: child.stdout?.on('data', (chunk) => { out += chunk })
L36: child.on('error', (err) => settle(reject, err))
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/engine/cli_install.jsView on unpkg · L3Findings
3 High4 Medium5 Low
HighSandbox Evasion Gated Capabilitysrc/engine/cli_install.js
HighSemantic Analysis Limitedsrc/api/client_timeout.test.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/engine/cli_install.js
MediumDynamic Requirebin/happyskills.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to happyskills@4.3.0.
See all versions of happyskills for other recorded verdicts.
- Review the evidence and your use of happyskills@4.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.