registry / skillstore / 0.1.10

skillstore@0.1.10

Skillstore CLI - AI Skills marketplace for Claude Code

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `skillstore install <skill>` or installs a pack.

Impact

A network attacker or compromised configured API can deliver arbitrary skill content into user-selected or canonical AI-agent skill directories.

Mechanism

Remote skill download, ZIP extraction, and agent-skill linking with forgeable manifest verification.

Rationale

No concrete self-propagating or install-time malicious behavior is present, but the package is a user-invoked AI-agent extension installer with broken manifest trust validation. This is a real dangerous capability and critical supply-chain weakness, not a clean package.

Evidence

package.jsondist/cli/index.jsdist/commands/install.jsdist/lib/plugin-config.jsdist/lib/plugin-verify.jsdist/lib/installer.js$HOME/.agents/skills/<slug>$HOME/.agents/.skill-lock.json<user-selected-dir>/<slug>

Network endpoints4

skillstore.io/apiskillstore.io/api/packs/<slug>/manifest

skillstore.io/api/skills/<slug>/manifest

skillstore.io/api/telemetry/effectiveness

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/lib/plugin-verify.js` embeds the HMAC verification key, so legacy manifest signatures can be forged.
`dist/lib/plugin-verify.js` verifies Ed25519 signatures using a public key supplied by the untrusted manifest rather than a pinned key.
`dist/commands/install.js` downloads ZIP artifacts and installs them into AI-agent skill directories after explicit CLI use.
`dist/lib/installer.js` extracts downloaded files and creates symlinks/copies into selected agent skill paths.

Evidence against

`package.json` has no preinstall/install/postinstall hook; only `prepublishOnly` runs.
`dist/cli/index.js` activates operations only through explicit CLI subcommands.
No child-process execution, credential harvesting, shell invocation, or destructive behavior was found.
Network requests target the configured Skillstore API; telemetry is limited to install/usage reporting.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 149 KB of source, external domains: skillstore.io

Source & flagged code

4 flagged

dist/lib/plugin-verify.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/lib/plugin-verify.js` embeds the HMAC verification key, so legacy manifest signatures can be forged.

dist/lib/plugin-verify.jsView on unpkg

•Published source reference

Medium

Ai Review Evidence

`dist/lib/plugin-verify.js` verifies Ed25519 signatures using a public key supplied by the untrusted manifest rather than a pinned key.

dist/lib/plugin-verify.jsView on unpkg

dist/commands/install.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/commands/install.js` downloads ZIP artifacts and installs them into AI-agent skill directories after explicit CLI use.

dist/commands/install.jsView on unpkg

dist/lib/installer.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/lib/installer.js` extracts downloaded files and creates symlinks/copies into selected agent skill paths.

dist/lib/installer.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/lib/plugin-verify.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/lib/plugin-verify.js` embeds the HMAC verification key, so legacy manifest signatures can be forged.

dist/lib/plugin-verify.jsView on unpkg

•Published source reference

Medium

Ai Review Evidence

`dist/lib/plugin-verify.js` verifies Ed25519 signatures using a public key supplied by the untrusted manifest rather than a pinned key.

dist/lib/plugin-verify.jsView on unpkg

dist/commands/install.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/commands/install.js` downloads ZIP artifacts and installs them into AI-agent skill directories after explicit CLI use.

dist/commands/install.jsView on unpkg

dist/lib/installer.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/lib/installer.js` extracts downloaded files and creates symlinks/copies into selected agent skill paths.

dist/lib/installer.jsView on unpkg

Findings

6 Medium4 Low

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencedist/lib/plugin-verify.js

MediumAi Review Evidencedist/commands/install.js

MediumAi Review Evidencedist/lib/installer.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

LPM CLI

Source & flagged code

4 flagged

dist/lib/plugin-verify.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/lib/plugin-verify.js` embeds the HMAC verification key, so legacy manifest signatures can be forged.

dist/lib/plugin-verify.jsView on unpkg

•Published source reference

Medium

Ai Review Evidence

`dist/lib/plugin-verify.js` verifies Ed25519 signatures using a public key supplied by the untrusted manifest rather than a pinned key.

dist/lib/plugin-verify.jsView on unpkg

dist/commands/install.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/commands/install.js` downloads ZIP artifacts and installs them into AI-agent skill directories after explicit CLI use.

dist/commands/install.jsView on unpkg

dist/lib/installer.jsView file

•Published source reference

Medium

Ai Review Evidence

`dist/lib/installer.js` extracts downloaded files and creates symlinks/copies into selected agent skill paths.

dist/lib/installer.jsView on unpkg