rainskills@0.1.35
Interactive Rainbond skill installer for Codex, Claude Code, Pi Agent, DeepSeek Harness, WorkBuddy, and Hermes Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo automatic install hook or self-dependency chain was found. The explicit setup capabilities and AI-directed installer text warrant a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI installer or the explicit ssh prepare command.
Impact
A user or an AI following embedded instructions could grant the package capabilities across agent tools or persistent access to a selected server.
Mechanism
Agent configuration writes and SSH authorized-key provisioning.
AI rationale
No automatic install hook or self-dependency chain was found. The explicit setup capabilities and AI-directed installer text warrant a warning rather than a block.
Evidence
install.shrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.claude/skills$HOME/.codex/skills$HOME/.pi/agent/skills$HOME/.dsh/skills$HOME/.workbuddy-ai/skills$HOME/.hermes/skills$HOME/.ssh/id_ed25519$HOME/.ssh/authorized_keys
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The installer contains instructions directed at AI assistants, which is reviewer and agent manipulation.
- An explicit SSH preparation command creates a key pair and adds its public key to the selected remote account’s authorized keys.
- The default all-target installation writes skills into several AI-agent configuration directories.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The SSH behavior requires an explicit ssh prepare command, a supplied target, and an interactive terminal.
- The platform installer stops before changes unless installation is confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedinstall.shView file
2855patternName = generic_password
severity = medium
line = 2855
Medium
•path = install.sh
kind = build_helper
sizeBytes = 98041
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
2 Critical1 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltabin/rainskills-tools.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.35.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.