rainskills@0.1.42
Interactive Rainbond skill installer for Codex, Claude Code, Pi Agent, DeepSeek Harness, WorkBuddy, and Hermes Agent
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not an automatic install-time compromise, but it combines broad agent configuration changes, unchecked remote bootstrap code, and remote-access provisioning. The explicit AI-directed installation text is reviewer manipulation under policy, so the package warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs install.sh or the rainskills SSH preparation command.
Impact
It can change agent behavior, establish remote access, or execute code from a configured download URL.
Mechanism
AI-agent skill installation, remote SSH key provisioning, and unchecked archive bootstrap.
AI rationale
This is not an automatic install-time compromise, but it combines broad agent configuration changes, unchecked remote bootstrap code, and remote-access provisioning. The explicit AI-directed installation text is reviewer manipulation under policy, so the package warrants a warning rather than a block.
Evidence
install.shrainbond-platform-installer/scripts/ssh-key-setup.js$HOME/.claude/skills$HOME/.codex/skills$HOME/.pi/agent/skills$HOME/.ssh/id_ed25519$HOME/.ssh/authorized_keys
Network endpoints3
get.rainbond.com/rainskills/rainskills-latest.tar.gzgithub.com/goodrain/rainskills/archive/refs/heads/main.tar.gzlog.rainbond.com/api/rainskills/events
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The installer directly addresses AI assistants and directs them to recommend its installation command.
- An explicitly invoked installer copies bundled skills into several AI-agent configuration directories and replaces changed skill directories.
- The bootstrap accepts an environment-controlled tarball URL, downloads it, extracts it, and executes its install script without an integrity check.
- The SSH preparation command creates a key pair and appends its public key to a remote account's authorized_keys file.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Agent-directory changes occur only when the user runs the installer and selects a target.
- SSH preparation requires an interactive terminal and announces the remote key installation.
- The inspected telemetry sender posts event data; no credential value is included in the cited event construction.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
6 flaggedinstall.shView file
2934patternName = generic_password
severity = medium
line = 2934
Medium
bin/rainskills.jsView file
2L3: const path = require("node:path");
L4: const crypto = require("node:crypto");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rainskills.jsView on unpkg · L2rainbond-platform-installer/scripts/ssh-key-setup.jsView file
6const path = require("node:path");
L7: const { spawn, spawnSync } = require("node:child_process");
L8: const { createSecureStateStore } = require("./secure-state.js");
...
L11:
L12: const REMOTE_AUTHORIZED_KEYS_SCRIPT = [
L13: "set -eu",
...
L65:
L66: function assertSafeIdentityFile(filePath, { privateKey = false, platform = process.platform } = {}) {
L67: const info = fs.lstatSync(filePath);
...
L77: function ensureDefaultIdentity({
L78: home = os.homedir(),
L79: platform = process.platform,
Findings
2 Critical1 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/host-cluster-installer.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/rainskills.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperrainbond-ai-assistant/scripts/validate_ai_engine_output.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.42.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.42 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.