registry / skills-layer / 0.1.5

skills-layer@0.1.5

⚠ Under review

Public CLI for Skills Layer Cloud.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 264 KB of source, external domains: 127.0.0.1, api.example.com, api.skills-layer.com, github.com, gitlab.com, staging.findfigg.co.uk

Source & flagged code

6 flagged

tests/public-cli-package.test.mjsView file

Lines 1-36javascript

1import { execFile } from "node:child_process";

2import test from "node:test";

High

Child Process

Package source references child process execution.

tests/public-cli-package.test.mjsView on unpkg · L1

3import assert from "node:assert/strict";

4import { mkdtemp, readFile } from "node:fs/promises";

5import { tmpdir } from "node:os";

6import { join } from "node:path";

7import { fileURLToPath } from "node:url";

9const packageUrl = new URL("../package.json", import.meta.url);

10const runtimeUrl = new URL("../public/skills-layer-public.mjs", import.meta.url);

11const readmeUrl = new URL("../README.md", import.meta.url);

12const licenseUrl = new URL("../LICENSE", import.meta.url);

13const wrapperUrl = new URL("../scripts/skills-layer.mjs", import.meta.url);

14const binPath = fileURLToPath(new URL("../bin/skills-layer.js", import.meta.url));

16async function loadRuntime() {

17 return await import(runtimeUrl.href);

18}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/public-cli-package.test.mjsView on unpkg · L16

20async function makeHome() {

21 return await mkdtemp(join(tmpdir(), "skills-layer-cli-package-home-"));

22}

24function packageEnv(home) {

25 const env = {

26 ...process.env,

27 HOME: home,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

tests/public-cli-package.test.mjsView on unpkg · L1

28 SKILLS_LAYER_NO_BANNER: "1"

29 };

30 delete env.SKILLS_LAYER_API_KEY;

31 delete env.SKILLS_LAYER_BASE_URL;

32 delete env.SKILLS_LAYER_MCP_TOKEN;

33 return env;

34}

36async function runPublic(args, options = {}) {

•matchType = previous_version_dangerous_delta matchedPackage = skills-layer@0.1.4 matchedIdentity = npm:c2tpbGxzLWxheWVy:0.1.4 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

tests/public-cli-package.test.mjsView on unpkg

public/skills-layer-public.mjsView file

Lines 1-22javascript

1/* istanbul ignore file -- generated npm bundle is verified by boundary and tarball smoke tests. */

2import { createRequire as __skillsLayerCreateRequire } from "node:module"; const require = __skillsLayerCreateRequire(import.meta.url);

3import{spawn as

Source & flagged code

6 flagged · loading source

tests/public-cli-package.test.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code