registry / rainskills / 0.1.37
rainskills@0.1.37
Interactive Rainbond skill installer for Codex, Claude Code, Pi Agent, DeepSeek Harness, WorkBuddy, and Hermes Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install lifecycle hook, self-dependency, credential exfiltration, or covert payload execution was found. The package nevertheless automatically updates first-party AI-agent extensions and includes explicit remote-access setup, so it warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run rainskills runtime status --json for automatic updating, or rainskills ssh prepare for SSH setup.
Impact
Updated skills can change agent behavior; SSH setup grants the generated local key remote access to the selected host.
Mechanism
Self-update of agent skills and explicit SSH authorized-key installation.
AI rationale
No install lifecycle hook, self-dependency, credential exfiltration, or covert payload execution was found. The package nevertheless automatically updates first-party AI-agent extensions and includes explicit remote-access setup, so it warrants a warning rather than a block.
Evidence
bin/rainskills.jsrainbond-platform-installer/scripts/auto-update.jsrainbond-platform-installer/scripts/ssh-key-setup.jsscripts/install-local-cli.mjs~/.codex/skills~/.claude/skills~/.agents/skills~/.hermes/skills~/.codex/config.toml~/.claude.json~/.ssh/id_ed25519~/.ssh/authorized_keys
Network endpoints3
registry.npmjs.orgregistry.npmmirror.comcdn.npmmirror.com
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A status command can fetch a newer release and then install its runtime and synchronize installed AI skill directories.
- The updater targets several AI-agent skill roots and replaces installed skill directories.
- An explicit SSH command creates an ED25519 key and appends its public key to the chosen host's authorized_keys file.
- The local CLI installer can rewrite legacy Rainbond MCP entries in Codex and Claude configuration files.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- SSH key setup is reached only through an explicit ssh prepare command and requires an interactive terminal.
- The updater is limited to runtime status --json, validates package metadata and integrity, and invokes npm with ignore-scripts.
- The manifest has no runtime dependency on rainskills itself.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedinstall.shView file
2856patternName = generic_password
severity = medium
line = 2856
Medium
•path = install.sh
kind = build_helper
sizeBytes = 98028
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
2 Critical1 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltabin/rainskills-tools.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.37.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.