rainskills@0.1.28
Interactive Rainbond skill installer for Codex, Claude Code, and Pi Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install lifecycle hook or self-dependency, so the evidence does not support a malware block. Its explicit CLI can still modify AI-agent control surfaces and remote SSH authorization, so it warrants a warning under the dangerous-capability policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the rainskills CLI, its runtime-status command, or ssh prepare.
Impact
The package can alter agent behavior through installed skills, replace prior skill content, report installation metadata, and establish SSH access to a user-selected host.
Mechanism
Agent skill installation and auto-update, telemetry reporting, and optional SSH key setup.
AI rationale
The package has no install lifecycle hook or self-dependency, so the evidence does not support a malware block. Its explicit CLI can still modify AI-agent control surfaces and remote SSH authorization, so it warrants a warning under the dangerous-capability policy.
Evidence
package.jsoninstall.shbin/rainskills.jsscripts/install-local-cli.mjsrainbond-platform-installer/scripts/auto-update.jsrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.claude/skills$HOME/.codex/skills$HOME/.pi/agent/skills$HOME/.ssh/id_ed25519$HOME/.ssh/id_ed25519.pub$HOME/.ssh/authorized_keys$HOME/.rainbond/rainskills/telemetry/events.jsonl
Network endpoints3
registry.npmjs.org/rainskills/latestregistry.npmmirror.com/rainskills/latestlog.rainbond.com/api/rainskills/lifecycle-events
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-run installer writes skills into Codex, Claude, and Pi agent directories and replaces differing skill trees.
- A normal runtime-status command can fetch a newer package release and replace installed skill directories.
- The explicit SSH preparation command generates a key and appends its public key to the selected server's authorized keys.
- The installer posts lifecycle telemetry to a Rainbond endpoint.
- The installer includes instructions addressed to AI assistants.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Agent and SSH changes are reached through explicit CLI commands, not npm installation.
- The updater accepts only fixed registries, validates SHA-512 integrity, and runs npm with scripts disabled.
- No source evidence shows credential harvesting, secret exfiltration, hidden shell execution, or a runtime self-dependency.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
5 flaggedinstall.shView file
2416patternName = generic_password
severity = medium
line = 2416
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 82498
magicHex = [redacted]
Medium
1053case "$TARGET" in
claude)
destinations+=("$HOME/.claude/skills")
;;
codex)
destinations+=("$HOME/.codex/skills")
;;
pi)
destinations+=("$HOME/.pi/agent/skills")
;;
all)
destinations+=("$HOME/.claude/skills")
destinations+=("$HOME/.codex/skills")
destinations+=("$HOME/.pi/agent/skills")
Medium
Ai Review Evidence
The user-run installer writes skills into Codex, Claude, and Pi agent directories and replaces differing skill trees.
install.shView on unpkg · L1053Findings
1 Critical7 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceinstall.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.28.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.