registry / rainskills / 0.1.15
rainskills@0.1.15
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a first-party agent extension installer with a guarded update mechanism and an explicit remote-access setup command. The capabilities warrant a warning, but source inspection found no unconsented npm lifecycle execution, credential exfiltration, or concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the rainskills CLI, especially its installer, runtime status, or ssh prepare command.
Impact
Installed skills can influence supported agents, newer package code can run through the limited update path, and the SSH command grants the local key remote login access.
Mechanism
User-invoked agent skill installation, guarded self-update, and SSH key setup.
AI rationale
This is a first-party agent extension installer with a guarded update mechanism and an explicit remote-access setup command. The capabilities warrant a warning, but source inspection found no unconsented npm lifecycle execution, credential exfiltration, or concrete malicious chain.
Evidence
package.jsoninstall.shbin/rainskills.jsrainbond-platform-installer/scripts/auto-update.jsrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.claude/skills$HOME/.codex/skills$HOME/.pi/agent/skills$HOME/.ssh/id_ed25519remote:$HOME/.ssh/authorized_keys
Network endpoints2
registry.npmjs.org/rainskills/latestregistry.npmmirror.com/
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-invoked installer copies package skills into Codex, Claude, and Pi agent directories.
- A runtime status command can download a newer package release and invoke its CLI.
- The explicit SSH command creates a local key and adds its public key to a remote authorized_keys file.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Agent-directory writes and SSH preparation are reached through named user commands.
- The update path restricts itself to npm registries and validates package integrity metadata.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedinstall.shView file
2423patternName = generic_password
severity = medium
line = 2423
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 81006
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
2 Critical6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/existing-kubernetes-installer.js
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.15.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.