registry / skills-layer / 0.1.9

skills-layer@0.1.9

⚠ Under review

Open-source CLI and local agent integration layer for Skills Layer Cloud.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 614 KB of source, external domains: 127.0.0.1, api.example.com, api.skills-layer.com, api.staging.findfigg.co.uk, github.com, gitlab.com, staging.findfigg.co.uk

Source & flagged code

4 flagged

public/skills-layer-public.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = skills-layer@0.1.4 matchedIdentity = npm:c2tpbGxzLWxheWVy:0.1.4 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

public/skills-layer-public.mjsView on unpkg

140`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(` L141: `,n)+1}return{type:t,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(t){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L142: import { createConnection } from "node:net";

High

Child Process

Package source references child process execution.

public/skills-layer-public.mjsView on unpkg · L140

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

public/skills-layer-public.mjsView on unpkg · L140

136`?yield*this.pushCount(1):t==="\r"&&this.charAt(1)===` L137: `?yield*this.pushCount(2):0}*pushSpaces(t){let n=this.pos-1,i;do i=this.buffer[++n];while(i===" "||t&&i===" ");let r=n-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),th... L138: `)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(` ... L140: `)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(` L141: `,n)+1}return{type:t,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(t){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L142: import { createConnection } from "node:net"; ... L149: function writeMessage(message) { L150: process.stdout.write(JSON.stringify(message) + "\\n"); L151: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

public/skills-layer-public.mjsView on unpkg · L136

Source & flagged code

4 flagged · loading source

public/skills-layer-public.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code