rainskills@0.1.13
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by the install-hook policy because no npm lifecycle hook or self-dependency executes it automatically. It is a high-impact explicit installer that mutates AI-agent extensions, persists credentials and shell loading, and can establish SSH access.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the rainskills CLI or install.sh and selecting an agent target, runtime connection, or SSH preparation.
Impact
A user who runs these commands grants the package broad agent-extension and deployment capability; the SSH command establishes persistent access to the selected host.
Mechanism
Explicit installer mutation of agent skill directories, local runtime files, shell configuration, and optional SSH authorized keys.
AI rationale
The package is not malicious by the install-hook policy because no npm lifecycle hook or self-dependency executes it automatically. It is a high-impact explicit installer that mutates AI-agent extensions, persists credentials and shell loading, and can establish SSH access.
Evidence
package.jsoninstall.shscripts/install-local-cli.mjsrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.codex/skills$HOME/.claude/skills$HOME/.pi/agent/skills$HOME/.rainbond/mcp.env$HOME/.rainbond/lib$HOME/.ssh/id_ed25519$HOME/.ssh/authorized_keys
Network endpoints3
get.rainbond.com/rainskills/rainskills-latest.tar.gzgithub.com/goodrain/rainskills/archive/refs/heads/main.tar.gzlog.rainbond.com/api/rainskills/installations
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The installer text directs AI assistants how to install the package.
- An explicit installer command copies package skills into Codex, Claude, and Pi Agent directories.
- The installer creates an SSH key and adds its public key to a chosen remote host.
- The installer sends installation status telemetry to Rainbond.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no self-dependency.
- Agent configuration changes occur only through the user-invoked installer; legacy MCP migration is narrowly scoped and backed up.
- The reviewed telemetry payload contains installation identifiers and status fields, not the Rainbond JWT.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedinstall.shView file
2423patternName = generic_password
severity = medium
line = 2423
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 81006
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
2 Critical6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/existing-kubernetes-installer.js
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.13.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.