registry / skillloader-mcp / 0.1.4

skillloader-mcp@0.1.4

SkillLoader MCP launcher

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Install-time code fetches a platform executable from a GitHub release and saves it in the package bin directory. The CLI later executes that fetched binary.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall downloads the binary; explicit skillloader invocation runs it.

Impact

A changed or compromised release asset could execute arbitrary code when the CLI is run.

Mechanism

unverified remote binary download and launcher execution

Rationale

The source establishes an install-time remote executable fetch followed by user-invoked execution, but no direct malicious behavior is visible in the shipped JavaScript. Flag as a warning rather than block.

Evidence

package.jsonbin/install.jsbin/skillloader.jsbin/skillloaderbin/skillloader.exe

Network endpoints1

github.com/voodoosim/skillloader/releases/download/v0.1.1/

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

skillloader-mcp@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code