rainskills@0.1.49
Agent Skills for deploying, troubleshooting, and verifying applications on Rainbond from Codex, Claude Code, and other AI coding agents
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe explicitly invoked platform installer automatically transmits host and deployment details to the vendor's logging service without a consent prompt or opt-out. This is unauthorized data exfiltration, even though the npm package itself has no install lifecycle hook.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs `rainskills platform install`; the installer sends a startup message and may send more data on warnings or errors.
Impact
The vendor receives identifying host and deployment diagnostics without the user's informed consent.
Mechanism
The shell script collects `uname -a`, external IP, install identifiers and system details, then POSTs them to `log.rainbond.com`.
Attack narrative
Running `rainskills platform install` launches the bundled installer. It derives an identifier from `uname -a`, then automatically sends a startup event containing raw OS information, external IP, install identifiers and method to `log.rainbond.com`. Warnings, errors and failure diagnostics can send additional host, Docker and cluster details. The inspected installer provides no consent prompt or telemetry opt-out for these uploads.
AI rationale
The explicitly invoked platform installer automatically transmits host and deployment details to the vendor's logging service without a consent prompt or opt-out. This is unauthorized data exfiltration, even though the npm package itself has no install lifecycle hook.
Evidence
bin/rainskills.jsrainbond-platform-installer/assets/install-rainbond.sh
Network endpoints2
log.rainbond.com/dindloglog.rainbond.com/logCollect
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The `rainskills platform install` command launches the bundled Rainbond installer.
- The installer reads `uname -a`, hashes it into a UUID, then sends a startup message automatically.
- That message includes raw OS information, external IP, UUID, install attempt ID and method, and is POSTed to `https://log.rainbond.com/dindlog`.
- Installer failure diagnostics can also send external IP, OS and architecture, kernel version, Docker information, and cluster details to `https://log.rainbond.com/logCollect`.
- No consent prompt or telemetry opt-out was found for these installer uploads.
Evidence against
- The package has no npm lifecycle scripts, so the uploads are not triggered merely by installing the npm package.
- The SSH key setup finding is behind an explicit `rainskills ssh prepare` command and requires an interactive SSH session.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flaggedinstall.shView file
2934patternName = generic_password
severity = medium
line = 2934
Medium
bin/rainskills.jsView file
5const os = require("node:os");
L6: const { spawn } = require("node:child_process");
L7: const { pathToFileURL } = require("node:url");
High
bin/read-snapshot.jsView file
3const SCOPES = new Set(["runtime", "app", "component", "delivery"]);
L4: const { classifyTool } = require("./tool-policy.js");
L5: const SENSITIVE_KEY = /(?:authorization|jwt|token|password|secret|credential|private[_-]?key|cookie|certificate|ssl)/i;
Findings
1 Critical3 High6 Medium4 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
HighChild Processbin/rainskills.js
HighSame File Env Network Executionbin/runtime-smoke.js
HighSemantic Analysis Limitedrainbond-platform-installer/scripts/windows-platform.js#virtual:string-array:round1
MediumSecret Patterninstall.sh
MediumDynamic Requirebin/read-snapshot.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperrainbond-ai-assistant/scripts/validate_ai_engine_output.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to rainskills@0.1.49.
See all versions of rainskills for other recorded verdicts.
- Avoid installing rainskills@0.1.49. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.