rainskills@0.1.6
Interactive Rainbond skill installer for Codex and Claude Code
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a dangerous, user-invoked agent and remote-access setup tool rather than an automatically executing npm malware package. Its AI-directed text, agent configuration, SSH key installation, and telemetry justify a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the rainskills installer with MCP setup enabled or invokes SSH preparation.
Impact
It can register a local MCP server for Codex or Claude, store Rainbond credentials, report lifecycle metadata, and grant the user's key access to a specified remote account.
Mechanism
User-invoked MCP registration, credential storage, telemetry, and SSH public-key installation.
AI rationale
This is a dangerous, user-invoked agent and remote-access setup tool rather than an automatically executing npm malware package. Its AI-directed text, agent configuration, SSH key installation, and telemetry justify a warning.
Evidence
package.jsoninstall.shrainbond-platform-installer/scripts/ssh-key-setup.jsrainbond-platform-installer/scripts/telemetry.jsrainbond-platform-installer/scripts/auto-update.js$HOME/.codex/config.toml$HOME/.claude.json$HOME/.rainbond/mcp.env$HOME/.ssh/id_ed25519$HOME/.ssh/authorized_keys
Network endpoints3
log.rainbond.com/api/rainskills/lifecycle-eventslog.rainbond.com/api/rainskills/installationsregistry.npmjs.org/rainskills/latest
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The installer addresses AI assistants with instructions about returning install commands.
- A user-run installer changes Codex and Claude MCP configuration to launch this package through npx.
- The SSH preparation command generates or uses a local key and appends its public key to a chosen remote account's authorized_keys file.
- The installer sends lifecycle telemetry to a Rainbond logging endpoint.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The package has no dependency on its own name; its only runtime dependencies are the MCP SDK and YAML.
- The risky configuration and SSH actions are reachable through explicit installer or command use, not package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedinstall.shView file
2604patternName = generic_password
severity = medium
line = 2604
matchedText = password...rd)"
Medium
•path = install.sh
kind = build_helper
sizeBytes = 89620
magicHex = [redacted]
Medium
pi/rainskills-mcp.tsView file
2941sourceCode = this.opts.code.process(sourceCode, sch);
L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2943: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
pi/rainskills-mcp.tsView on unpkg · L2941Findings
2 Critical5 Medium5 Low
CriticalPersistence Backdoorrainbond-platform-installer/scripts/ssh-key-setup.js
CriticalPrevious Version Dangerous Deltarainbond-platform-installer/scripts/existing-kubernetes-installer.js
MediumSecret Patterninstall.sh
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalpi/rainskills-mcp.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rainskills@0.1.6.
See all versions of rainskills for other recorded verdicts.
- Review the evidence and your use of rainskills@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.