skykoi@2026.3.529
SkyKoi — Koi runtime. Multi-channel gateway CLI with RPC Koi.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic hints overstate bundled runtime primitives: inspected dynamic evaluation is dependency code, while CLI behavior is explicitly user-invoked. No lifecycle hook or concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the skykoi/koi CLI or configures gateway features.
Impact
No unconsented credential exfiltration, remote payload execution, persistence, or foreign AI-agent control-surface mutation was confirmed.
Mechanism
User-configured gateway and agent runtime operations.
AI rationale
Static hints overstate bundled runtime primitives: inspected dynamic evaluation is dependency code, while CLI behavior is explicitly user-invoked. No lifecycle hook or concrete malicious chain was found.
Evidence
package.jsonskykoi.mjsdist/index.jsdist/reply-CbHF6Gva.jsdist/login-qr-qGKjDzt6.js
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- skykoi.mjs only enables compile cache then imports the local dist entrypoint.
- The flagged eval/new Function uses are bundled dependency compatibility/deprecation code.
- Runtime network and command features are tied to the advertised user-invoked gateway/agent CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
23 flagged · loading sourcedist/esm-EiZfw_GY.jsView file
5594patternName = generic_password
severity = medium
line = 5594
matchedText = password...d]",
Medium
dist/dist-H7dfVGXo.jsView file
33370const executable_response_1 = require_executable_response();
L33371: const childProcess = __require("child_process");
L33372: const fs$2 = __require("fs");
High
Child Process
Package source references child process execution.
dist/dist-H7dfVGXo.jsView on unpkg · L3337082}
L83: const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
L84: if (gacPath) [redacted] = _existsSync(gacPath);
L85: else [redacted] = _existsSync(_join(_homedir(), ".config", "gcloud", "application_default_credentials.json"));
L86: }
...
L129: provider: "amazon-bedrock",
L130: baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
L131: reasoning: false,
...
L12537: //#region node_modules/.pnpm/@anthropic-ai+sdk@0.73.0_zod@4.3.6/node_modules/@anthropic-ai/sdk/internal/tslib.mjs
L12538: function __classPrivateFieldSet$1(receiver, state, value, kind, f) {
L12539: if (kind === "m") throw new TypeError("Private method is not writable");
...
L12677: try {
Findings
6 Critical11 High8 Medium7 Low
CriticalCredential Exfiltrationdist/reply-CbHF6Gva.js
CriticalCommand Output Exfiltrationdist/reply-CbHF6Gva.js
CriticalRemote Asset Decode Executedist/login-qr-qGKjDzt6.js
CriticalRemote Response Code Executiondist/reply-CbHF6Gva.js
CriticalTrigger Reachable Dangerous Capabilitydist/reply-CbHF6Gva.js
CriticalPrevious Version Dangerous Deltadist/dist-q86J2Uh_.js
HighChild Processdist/dist-H7dfVGXo.js
HighShelldist/runner-Bpn6wwaq.js
HighEvaldist/login-qr-qGKjDzt6.js
HighCloud Metadata Accessdist/dist-H7dfVGXo.js
HighObfuscated Payload Loaderdist/login-qr-qGKjDzt6.js
Affected versions and remediation
This report applies to skykoi@2026.3.529.
See all versions of skykoi for other recorded verdicts.
- Review the evidence and your use of skykoi@2026.3.529 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.