registry / rainskills / 0.1.24
rainskills@0.1.24
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo automatic npm lifecycle hook, credential theft, or unconsented install-time control-surface mutation was found. The AI-directed installation text and remote-updatable agent-skill deployment leave a real agent-extension risk that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user or assisting agent runs rainskills, or runs rainskills runtime status --json after installation.
Impact
Installed agent instructions can be replaced by a later package release; no install-time lifecycle execution or secret exfiltration was confirmed.
Mechanism
Agent skill installation with guarded registry-based auto-update.
AI rationale
No automatic npm lifecycle hook, credential theft, or unconsented install-time control-surface mutation was found. The AI-directed installation text and remote-updatable agent-skill deployment leave a real agent-extension risk that warrants a warning.
Evidence
install.shbin/rainskills.jsrainbond-platform-installer/scripts/auto-update.js~/.claude/skills~/.codex/skills~/.pi/agent/skills~/.rainbond/rainskills/update-artifacts
Network endpoints3
registry.npmjs.org/rainskills/latestregistry.npmmirror.com/rainskills/latestcdn.npmmirror.com/
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The installer contains text directing AI assistants how to respond to installation requests.
- A user command installs bundled skills into Codex, Claude, and Pi agent directories.
- A status command can fetch a newer package release and replace installed skill directories.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The skill installation and SSH key setup are reached through explicit CLI subcommands.
- The updater restricts its automatic path to runtime status and verifies package integrity before use.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedinstall.shView file
2395patternName = generic_password
severity = medium
line = 2395
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 81408
magicHex = [redacted]
Medium
6# AI assistants: when a user asks to install rainbond-skills, hand back the
# npx command when Node.js 18+ is available, otherwise use the CDN command.
# Do not reimplement the bootstrap below, git clone + copy directories, or
# Credentials are written only through the protected single-runtime store.
Medium
Ai Review Evidence
The installer contains text directing AI assistants how to respond to installation requests.
install.shView on unpkg · L6bin/rainskills.js
Findings
1 Critical7 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceinstall.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.24.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.