registry / rainskills / 0.1.11
rainskills@0.1.11
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe source ties the flagged SSH key write to an interactive, user-invoked setup command and limits it to the selected host. The inspected package manifest and installer code do not support the scanner’s malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user must invoke SSH preparation in an interactive terminal or confirm the Windows installation flow.
Impact
These actions support the requested setup flows; the inspected source does not establish unauthorized access or other concrete attack behavior.
Mechanism
SSH preparation installs the user’s public key on the selected host; the Windows installer checks approved HTTPS origins for artifacts and redirects.
AI rationale
The source ties the flagged SSH key write to an interactive, user-invoked setup command and limits it to the selected host. The inspected package manifest and installer code do not support the scanner’s malicious verdict.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and lists build, check, and packaging scripts; I found no install lifecycle hook.
- The SSH key setup is routed through an explicit CLI command, requires an interactive terminal, and adds a public key to the selected host’s authorized keys.
- The local installer only removes a matching legacy Rainbond MCP entry from Codex configuration when run; it leaves other sections intact.
- The Windows installer requires confirmation before enabling WSL and restricts artifact downloads and redirects to allowed HTTPS origins.
Evidence against
- The flagged SSH key write is part of an interactive, user-invoked setup flow, not an automatic package-install action.
- The inspected installer behavior does not establish credential theft, an unauthorized persistent backdoor, or an attack on unrelated agent configuration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggedinstall.shView file
2423patternName = generic_password
severity = medium
line = 2423
Medium
•path = install.sh
kind = build_helper
sizeBytes = 81006
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
1 Critical1 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
HighSemantic Analysis Limitedrainbond-platform-installer/scripts/windows-platform.js#virtual:string-array:round1
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.11.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.