rainskills@0.1.41
Interactive Rainbond skill installer for Codex, Claude Code, Pi Agent, DeepSeek Harness, WorkBuddy, and Hermes Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no npm install lifecycle hook, so the evidence does not establish an unconsented install-time attack. Its unverified remote bootstrap and explicit broad AI-agent/SSH mutation leave a concrete dangerous capability that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs rainskills, install.sh, or the ssh prepare subcommand.
Impact
A compromised download endpoint could run code during explicit installation; the package can also change selected agent capabilities and enable key-based access to a chosen server.
Mechanism
Remote archive bootstrap plus AI-agent configuration and optional SSH key installation.
AI rationale
The package has no npm install lifecycle hook, so the evidence does not establish an unconsented install-time attack. Its unverified remote bootstrap and explicit broad AI-agent/SSH mutation leave a concrete dangerous capability that warrants a warning.
Evidence
install.shrainbond-platform-installer/scripts/host-targets.jsrainbond-platform-installer/scripts/windows-onboarding.jsrainbond-platform-installer/scripts/ssh-key-setup.js~/.claude/skills~/.codex/skills~/.pi/agent/skills~/.dsh/skills~/.workbuddy-ai/skills~/.hermes/skills~/.rainbond/bin~/.rainbond/lib$HOME/.ssh/authorized_keys
Network endpoints1
get.rainbond.com/rainskills/rainskills-latest.tar.gz
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The shell installer fetches a latest tarball from a network endpoint without an integrity check, extracts it, and executes its install script.
- The user-invoked installer writes bundled skills into several AI-agent skill directories and installs a local runtime bundle.
- The SSH preparation command appends a generated public key to the selected remote account’s authorized-keys file.
- The shell installer directly addresses AI assistants and instructs them how to invoke it.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The agent target must be supplied or selected interactively; non-interactive use without a target fails.
- The SSH routine requires an interactive terminal and a user-supplied SSH target.
- Telemetry is opt-out and the inspected event schema contains installation metadata rather than credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedinstall.shView file
2871patternName = generic_password
severity = medium
line = 2871
Medium
•path = install.sh
kind = build_helper
sizeBytes = 98554
magicHex = [redacted]
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2Findings
2 Critical1 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/windows-onboarding.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.41.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.