registry / skillmoo / 0.3.4

skillmoo@0.3.4

Grade the AI agent skills you've installed — safety, token bloat, and conflicts. 100% local static analysis, no model, no signup.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Running `skillmoo scan` in an interactive terminal automatically uploads a report unless suppressed. The report contains discovered AI-skill metadata and findings, not source contents.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `skillmoo scan` with a TTY and without --no-share, --json, --report, or --publish.

Impact

Unexpected disclosure of local agent-skill paths and derived security metadata.

Mechanism

Automatic POST of discovered AI-skill analysis metadata.

Rationale

Source inspection confirms unexpected automatic metadata egress during a user-invoked scan, contradicting the local-only positioning. It does not show a concrete malicious payload or unconsented install-time control-surface mutation.

Evidence

package.jsonbin/skillmoo.mjsREADME.md~/.claude/skills~/.claude/plugins~/.codex/skills.claude/skills.codex/skills.cursor/rules.github/copilot-instructions.md.github/instructions.clinerules.windsurf/rules

Network endpoints1

skillmoo.com/api/report

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

bin/skillmoo.mjs auto-publishes interactive scan results unless --no-share is used.
bin/skillmoo.mjs POSTs scan data to ${SKILLMOO_API||https://skillmoo.com}/api/report.
Published data includes discovered skill paths, names, findings, grades, and token metadata.
The manifest describes the CLI as fully local, conflicting with default interactive upload behavior.

Evidence against

package.json has only prepublishOnly; installation has no lifecycle hook.
No child-process execution, dynamic code loading, credential harvesting, or persistence writes were found.
The only writeFileSync call is an explicit --report/--html local HTML output.
publishReport serializes analysis metadata, not scanned SKILL.md contents.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 98.3 KB of source, external domains: skillmoo.com

Source & flagged code

3 flagged

bin/skillmoo.mjsView file

Lines 15-55javascript

15 if (depth < 0) return;

16 let entries;

17 try {

18 entries = readdirSync(dir);

19 } catch {

20 return;

21 }

22 for (const e of entries) {

23 if (e.startsWith(".") && e !== ".claude" && e !== ".codex") continue;

24 if (SKIP.has(e)) continue;

25 const p = join(dir, e);

26 let st;

27 try {

28 st = statSync(p);

29 } catch {

30 continue;

31 }

32 if (st.isDirectory()) walk(p, depth - 1, match, out);

33 else if (match(e)) out.push(p);

34 }

35}

36function defaultRoots(cwd = process.cwd()) {

37 const h = homedir();

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/skillmoo.mjsView on unpkg · L35

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/skillmoo.mjsView on unpkg · L35

38 return [

39 // Claude Code + Codex — SKILL.md

40 { dir: join(h, ".claude", "skills"), source: "Claude Code \xB7 user", match: isSkillMd },

41 { dir: join(cwd, ".claude", "skills"), source: "Claude Code \xB7 project", match: isSkillMd },

42 { dir: join(h, ".claude", "plugins"), source: "Claude Code \xB7 plugins", match: isSkillMd },

43 { dir: join(h, ".codex", "skills"), source: "Codex \xB7 user", match: isSkillMd },

44 { dir: join(cwd, ".codex", "skills"), source: "Codex \xB7 project", match: isSkillMd },

45 // Cursor

46 { dir: join(cwd, ".cursor", "rules"), source: "Cursor \xB7 rules", match: (e) => /\.mdc$/i.test(e) },

47 { dir: join(cwd, ".cursorrules"), source: "Cursor \xB7 .cursorrules", file: true },

48 // GitHub Copilot

49 { dir: join(cwd, ".github", "copilot-instructions.md"), source: "Copilot \xB7 instructions", file: true },

50 { dir: join(cwd, ".github", "instructions"), source: "Copilot \xB7 instructions", match: (e) => /\.instructions\.md$/i.test(e) },

51 // Cline — .clinerules can be a single file OR a directory of *.md

52 { dir: join(cwd, ".clinerules"), source: "Cline \xB7 rules", match: (e) => /\.md$/i.test(e) },

53 { dir: join(cwd, ".clinerules"), source: "Cline \xB7 rules", file: true },

54 { dir: join(h, "Documents", "Cline", "Rules"), source: "Cline \xB7 user", match: (e) => /\.md$/i.test(e) },

55 // Windsurf

Lines 238-278javascript

238 });

239 }

240 }

241 for (const c2 of capabilities) {

242 if (c2.severity === "critical") {

243 findings.push({ severity: "critical", category: "shell", title: `Script capability: ${c2.label.toLowerCase()}`, detail:

Source & flagged code

3 flagged · loading source

bin/skillmoo.mjsView file

35} L36: function defaultRoots(cwd = process.cwd()) { L37: const h = homedir(); ... L160: "ps1", L161: "powershell", L162: "python", ... L173: ]); L174: var SHELLISH = /(^|\n)\s*(?:curl|wget|rm|sudo|cat|echo|export|pip3?|npm|apt|brew|chmod|chown|ssh|scp|nc|bash|sh|eval|python3?|node|base64)\b/; L175: function extractScripts(md) { ... L189: { cap: "exec", label: "Executes code", severity: "critical", re: /\b(?:curl|wget)\b[^\n|]{0,120}\|\s*(?:sudo\s+)?(?:ba)?sh\b/i, detail: "downloads a remote script and runs it (curl... L190: { cap: "exec", label: "Executes code", severity: "critical", re: /\/dev\/tcp\/\d|\bnc\b[^\n]{0,30}\s-e\b|\bncat\b[^\n]{0,30}--exec|\b(?:ba)?sh\s+-i\b[^\n]{0,24}(?:>&|<&|\d>&)|mkfif... L191: { cap: "encoded", label: "Runs encoded content", severity: "critical", re: /(?:base64\s+(?:-d|--decode)|xxd\s+-r|openssl\s+enc\s+-d|gunzip|zcat)[^\n]{0,50}\|\s*(?:sudo\s+)?(?:ba)?s...

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/skillmoo.mjsView on unpkg · L35

258contains invisible/control Unicode U+200B (zero width space) var ZERO_WIDTH = /[<U+200B>-<U+200F><U+202A>-<U+202E><U+2060>-⁤<U+FEFF>]/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

bin/skillmoo.mjsView on unpkg · L258

35Trigger-reachable chain: manifest.bin -> bin/skillmoo.mjs L35: } L36: function defaultRoots(cwd = process.cwd()) { L37: const h = homedir(); ... L160: "ps1", L161: "powershell", L162: "python", ... L173: ]); L174: var SHELLISH = /(^|\n)\s*(?:curl|wget|rm|sudo|cat|echo|export|pip3?|npm|apt|brew|chmod|chown|ssh|scp|nc|bash|sh|eval|python3?|node|base64)\b/; L175: function extractScripts(md) { ... L189: { cap: "exec", label: "Executes code", severity: "critical", re: /\b(?:curl|wget)\b[^\n|]{0,120}\|\s*(?:sudo\s+)?(?:ba)?sh\b/i, detail: "downloads a remote script and runs it (curl... L190: { cap: "exec", label: "Executes code", severity: "critical", re: /\/dev\/tcp\/\d|\bnc\b[^\n]{0,30}\s-e\b|\bncat\b[^\n]{0,30}--exec|\b(?:ba)?sh\s+-i\b[^\n]{0,24}(?:>&|<&|\d>&)|mkfif... L191: { cap: "encoded", label: "Runs encoded content", severity: "critical", re: /(?:base64\s+(?:-d|--decode)|xxd\s+-r|openssl\s+enc\s+-d|gunzip|zcat)[^\n]{0,50}\|\s*(?:sudo\s+)?(?:ba)?s...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/skillmoo.mjsView on unpkg · L35

Findings

3 Critical3 Medium6 Low

CriticalPersistence Backdoorbin/skillmoo.mjs

CriticalTrojan Source Unicodebin/skillmoo.mjs

CriticalTrigger Reachable Dangerous Capabilitybin/skillmoo.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/skillmoo.mjsView file

Lines 15-55javascript

15 if (depth < 0) return;

16 let entries;

17 try {

18 entries = readdirSync(dir);

19 } catch {

20 return;

21 }

22 for (const e of entries) {

23 if (e.startsWith(".") && e !== ".claude" && e !== ".codex") continue;

24 if (SKIP.has(e)) continue;

25 const p = join(dir, e);

26 let st;

27 try {

28 st = statSync(p);

29 } catch {

30 continue;

31 }

32 if (st.isDirectory()) walk(p, depth - 1, match, out);

33 else if (match(e)) out.push(p);

34 }

35}

36function defaultRoots(cwd = process.cwd()) {

37 const h = homedir();

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/skillmoo.mjsView on unpkg · L35

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/skillmoo.mjsView on unpkg · L35

38 return [

39 // Claude Code + Codex — SKILL.md

40 { dir: join(h, ".claude", "skills"), source: "Claude Code \xB7 user", match: isSkillMd },

41 { dir: join(cwd, ".claude", "skills"), source: "Claude Code \xB7 project", match: isSkillMd },

42 { dir: join(h, ".claude", "plugins"), source: "Claude Code \xB7 plugins", match: isSkillMd },

43 { dir: join(h, ".codex", "skills"), source: "Codex \xB7 user", match: isSkillMd },

44 { dir: join(cwd, ".codex", "skills"), source: "Codex \xB7 project", match: isSkillMd },

45 // Cursor

46 { dir: join(cwd, ".cursor", "rules"), source: "Cursor \xB7 rules", match: (e) => /\.mdc$/i.test(e) },

47 { dir: join(cwd, ".cursorrules"), source: "Cursor \xB7 .cursorrules", file: true },

48 // GitHub Copilot

49 { dir: join(cwd, ".github", "copilot-instructions.md"), source: "Copilot \xB7 instructions", file: true },

50 { dir: join(cwd, ".github", "instructions"), source: "Copilot \xB7 instructions", match: (e) => /\.instructions\.md$/i.test(e) },

51 // Cline — .clinerules can be a single file OR a directory of *.md

52 { dir: join(cwd, ".clinerules"), source: "Cline \xB7 rules", match: (e) => /\.md$/i.test(e) },

53 { dir: join(cwd, ".clinerules"), source: "Cline \xB7 rules", file: true },

54 { dir: join(h, "Documents", "Cline", "Rules"), source: "Cline \xB7 user", match: (e) => /\.md$/i.test(e) },

55 // Windsurf

Lines 238-278javascript

238 });

239 }

240 }

241 for (const c2 of capabilities) {

242 if (c2.severity === "critical") {

243 findings.push({ severity: "critical", category: "shell", title: `Script capability: ${c2.label.toLowerCase()}`, detail: