skills-layer@0.1.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

skills-layer@0.1.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

tests/public-cli-package.test.mjsView file

1import { execFile } from "node:child_process"; L2: import test from "node:test";

High

Child Process

Package source references child process execution.

tests/public-cli-package.test.mjsView on unpkg · L1

1Cross-file remote execution chain: tests/public-cli-package.test.mjs spawns public/sk[redacted]; helper contains network access plus dynamic code execution. L1: import { execFile } from "node:child_process"; L2: import test from "node:test"; ... L8: L9: const packageUrl = new URL("../package.json", import.meta.url); L10: const runtimeUrl = new URL("../public/sk[redacted]", import.meta.url); ... L25: const env = { L26: ...process.env, L27: HOME: home, ... L40: cwd: options.cwd, L41: stdoutIsTty: false, L42: fetch: options.fetch ?? (async () => { throw new Error("Unexpected network call from package contract test."); }) ... L60: assert.equal(result.stderr, "");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

tests/public-cli-package.test.mjsView on unpkg · L1

16async function loadRuntime() { L17: return await import(runtimeUrl.href); L18: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/public-cli-package.test.mjsView on unpkg · L16

public/skills-layer-public.mjsView file

2import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url); L3: import{spawn as ki}from"node:child_process";import{createHash as Dt}from"node:crypto";import{access as wi,appendFile as as,chmod as vi,mkdir as Ne,readdir as bi,readFile as Oe,rm a... L4: import { createConnection } from "node:net"; L5: import { createInterface } from "node:readline";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

public/skills-layer-public.mjsView on unpkg · L2

2import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url); L3: import{spawn as ki}from"node:child_process";import{createHash as Dt}from"node:crypto";import{access as wi,appendFile as as,chmod as vi,mkdir as Ne,readdir as bi,readFile as Oe,rm a... L4: import { createConnection } from "node:net"; L5: import { createInterface } from "node:readline"; ... L11: function writeMessage(message) { L12: process.stdout.write(JSON.stringify(message) + "\\n"); L13: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

public/skills-layer-public.mjsView on unpkg · L2

Source & flagged code

5 flagged

tests/public-cli-package.test.mjsView file

Lines 1-36javascript

1import { execFile } from "node:child_process";

2import test from "node:test";

High

Child Process

Package source references child process execution.

tests/public-cli-package.test.mjsView on unpkg · L1

3import assert from "node:assert/strict";

4import { mkdtemp, readFile } from "node:fs/promises";

5import { tmpdir } from "node:os";

6import { join } from "node:path";

7import { fileURLToPath } from "node:url";

8

9const packageUrl = new URL("../package.json", import.meta.url);

10const runtimeUrl = new URL("../public/skills-layer-public.mjs", import.meta.url);

11const readmeUrl = new URL("../README.md", import.meta.url);

12const licenseUrl = new URL("../LICENSE", import.meta.url);

13const wrapperUrl = new URL("../scripts/skills-layer.mjs", import.meta.url);

14const binPath = fileURLToPath(new URL("../bin/skills-layer.js", import.meta.url));

15

16async function loadRuntime() {

17 return await import(runtimeUrl.href);

18}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/public-cli-package.test.mjsView on unpkg · L16

19

20async function makeHome() {

21 return await mkdtemp(join(tmpdir(), "skills-layer-cli-package-home-"));

22}

23

24function packageEnv(home) {

25 const env = {

26 ...process.env,

27 HOME: home,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

tests/public-cli-package.test.mjsView on unpkg · L1

28 SKILLS_LAYER_NO_BANNER: "1"

29 };

30 delete env.SKILLS_LAYER_API_KEY;

31 delete env.SKILLS_LAYER_BASE_URL;

32 delete env.SKILLS_LAYER_MCP_TOKEN;

33 return env;

34}

35

36async function runPublic(args, options = {}) {

public/skills-layer-public.mjsView file

Lines 1-22javascript

1/* istanbul ignore file -- generated npm bundle is verified by boundary and tarball smoke tests. */

2import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url);

3import{spawn as