registry / rainskills / 0.1.27
rainskills@0.1.27
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe persistence hint corresponds to an interactive SSH setup that installs a generated public key on the host selected by the user. The manifest has no npm install lifecycle hook, and the reviewed local CLI migration is limited to legacy RainSkills configuration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
SSH key setup runs when its explicit prepare command is invoked in an interactive terminal; platform installation requires confirmation unless --yes is supplied.
Impact
The SSH flow enables the requested identity to connect to the selected host; inspected source does not show an undisclosed recipient or broader persistence behavior.
Mechanism
The SSH flow uses a caller-selected host and generated public key to configure remote access. The local migration handles legacy RainSkills MCP entries in supported user configuration files.
AI rationale
The persistence hint corresponds to an interactive SSH setup that installs a generated public key on the host selected by the user. The manifest has no npm install lifecycle hook, and the reviewed local CLI migration is limited to legacy RainSkills configuration.
Evidence
rainbond-platform-installer/scripts/ssh-key-setup.jsrainbond-platform-installer/scripts/platform-installer.jsscripts/install-local-cli.mjspackage.json~/.ssh/authorized_keys
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the command through bin/rainskills.js; its scripts are build and development tasks, not npm install hooks.
- The required location in scripts/install-local-cli.mjs reads a safe Codex config and splits it into sections before migration.
- The local installer copies its runtime into the user’s .rainbond directory and removes only legacy RainSkills MCP entries from supported configs.
- SSH preparation requires an interactive terminal and a caller-specified target; the code warns that host confirmation and a server password may be required.
- The SSH command sends the generated public key to that target and adds it to the remote user’s authorized_keys file.
- The platform installer prompts for confirmation before beginning a Rainbond installation unless the caller explicitly uses --yes.
Evidence against
- ssh-key-setup.js writes a public key to remote authorized_keys, which creates continuing access; source shows this is the explicit SSH preparation flow for the selected host.
Behavioral surface
ChildProcess
Source & flagged code
6 flaggedinstall.shView file
2416patternName = generic_password
severity = medium
line = 2416
Medium
•path = install.sh
kind = build_helper
sizeBytes = 82498
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
2 Critical1 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/platform-installer.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.27.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.