rainskills@0.1.4
Interactive Rainbond skill installer for Codex and Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains meaningful agent-control and remote-access capabilities, so it warrants a warning. Static source inspection found no automatic lifecycle hook, self-dependency chain, credential exfiltration, or covert payload execution that would justify a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the installer or explicitly invokes the SSH preparation command.
Impact
The package can add its MCP server to user agent settings and add a local public key to a selected remote host.
Mechanism
User-invoked agent configuration, telemetry reporting, and SSH key setup.
AI rationale
The package contains meaningful agent-control and remote-access capabilities, so it warrants a warning. Static source inspection found no automatic lifecycle hook, self-dependency chain, credential exfiltration, or covert payload execution that would justify a block.
Evidence
package.jsoninstall.shrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.codex/config.toml$HOME/.claude.json$HOME/.ssh/id_ed25519$HOME/.ssh/authorized_keys
Network endpoints2
log.rainbond.com/api/rainskills/installationslog.rainbond.com/api/rainskills/lifecycle-events
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-run installer reconfigures Codex and Claude MCP entries to launch this package through npx.
- The installer sends installation and lifecycle telemetry to log.rainbond.com.
- An interactive SSH preparation command adds a generated public key to the selected remote host's authorized_keys file.
Evidence against
- package.json defines no preinstall, install, or postinstall lifecycle hook.
- The agent configuration and SSH changes occur only through explicit installer or command execution.
- The SSH routine requires an interactive terminal and validates the target before running ssh.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedinstall.shView file
2604patternName = generic_password
severity = medium
line = 2604
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 89620
magicHex = [redacted]
Medium
pi/rainskills-mcp.tsView file
2941sourceCode = this.opts.code.process(sourceCode, sch);
L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2943: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
pi/rainskills-mcp.tsView on unpkg · L2941Findings
2 Critical5 Medium5 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/existing-kubernetes-installer.js
MediumSecret Patterninstall.sh
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalpi/rainskills-mcp.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.4.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.