rainskills@0.1.25
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a user-invoked installer with real AI-agent configuration and SSH-authorizing capabilities, so it merits a warning. Source inspection found no automatic lifecycle execution, self-dependency chain, or concrete malicious payload.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the rainskills installer or its ssh prepare command.
Impact
It can alter selected agent skill folders, store a Rainbond credential, send lifecycle metadata, and authorize SSH access to a specified server.
Mechanism
User-invoked agent extension installation, credential setup, telemetry, and SSH key provisioning.
AI rationale
This is a user-invoked installer with real AI-agent configuration and SSH-authorizing capabilities, so it merits a warning. Source inspection found no automatic lifecycle execution, self-dependency chain, or concrete malicious payload.
Evidence
package.jsoninstall.shscripts/install-local-cli.mjsrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.claude/skills$HOME/.codex/skills$HOME/.pi/agent/skills$HOME/.rainbond/rainskills/single-runtime-v1.json$HOME/.ssh/id_ed25519$HOME/.ssh/id_ed25519.pub$HOME/.ssh/authorized_keys
Network endpoints3
run.rainbond.comlog.rainbond.com/api/rainskills/installationslog.rainbond.com/api/rainskills/lifecycle-events
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit installer copies skills into Codex, Claude, and Pi agent directories.
- The explicit SSH preparation command generates a key and adds its public key to the chosen remote account.
- The installer can send installation lifecycle telemetry to a Rainbond endpoint when an attempt identifier is present.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no runtime self-dependency.
- The agent-directory and SSH changes require an explicit user command.
- The telemetry payload shown contains lifecycle metadata rather than the supplied token or password.
- The SSH path validates the target and requires an interactive terminal.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedinstall.shView file
2395patternName = generic_password
severity = medium
line = 2395
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 81408
magicHex = [redacted]
Medium
1053case "$TARGET" in
claude)
destinations+=("$HOME/.claude/skills")
;;
codex)
destinations+=("$HOME/.codex/skills")
;;
pi)
destinations+=("$HOME/.pi/agent/skills")
;;
all)
destinations+=("$HOME/.claude/skills")
destinations+=("$HOME/.codex/skills")
destinations+=("$HOME/.pi/agent/skills")
Medium
Ai Review Evidence
The explicit installer copies skills into Codex, Claude, and Pi agent directories.
install.shView on unpkg · L1053Findings
1 Critical7 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceinstall.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.25.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.