rainskills@0.1.5
Interactive Rainbond skill installer for Codex and Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a high-impact explicit setup tool rather than a confirmed malicious package. Its agent-control, credential-persistence, and remote-access capabilities warrant a warning, while the absence of automatic lifecycle execution and observed covert exfiltration makes blocking disproportionate.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the rainskills command or installer and completes the requested setup.
Impact
The package gains a durable execution path in configured AI clients and changes user and remote SSH configuration after user-directed setup.
Mechanism
Persistent agent configuration, credential setup, remote-key provisioning, and installation telemetry.
AI rationale
This is a high-impact explicit setup tool rather than a confirmed malicious package. Its agent-control, credential-persistence, and remote-access capabilities warrant a warning, while the absence of automatic lifecycle execution and observed covert exfiltration makes blocking disproportionate.
Evidence
package.jsoninstall.shbin/rainskills.jsrainbond-platform-installer/scripts/ssh-key-setup.jsrainbond-platform-installer/scripts/telemetry.js$HOME/.codex/config.toml$HOME/.claude.json$HOME/.rainbond/mcp.env$HOME/.zshrc$HOME/.bashrc$HOME/.profile$HOME/.ssh/id_ed25519$HOME/.ssh/authorized_keys
Network endpoints3
log.rainbond.com/api/rainskills/installationslog.rainbond.com/api/rainskills/lifecycle-eventsregistry.npmjs.org/rainskills/latest
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The installer directs AI assistants how to install it.
- A user-run installer adds a persistent Codex MCP entry that launches this package through npx.
- It writes a Rainbond JWT to a shell-loadable file and changes the user shell startup file.
- An explicit SSH preparation command creates a local key and adds its public key to a remote authorized-keys file.
- Installer telemetry is posted to Rainbond logging endpoints.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The risky configuration and SSH actions require explicit command execution and interactive or credential-gated setup.
- The installer backs up agent configuration before replacing its Rainbond entry.
- No source evidence showed secret harvesting, arbitrary remote payload execution, or destructive activity outside the selected setup paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
5 flaggedinstall.shView file
2604patternName = generic_password
severity = medium
line = 2604
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 89620
magicHex = [redacted]
Medium
pi/rainskills-mcp.tsView file
2941sourceCode = this.opts.code.process(sourceCode, sch);
L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2943: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
pi/rainskills-mcp.tsView on unpkg · L2941Findings
2 Critical5 Medium5 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/existing-kubernetes-installer.js
MediumSecret Patterninstall.sh
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalpi/rainskills-mcp.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.5.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.