skykoi@2026.3.561
SkyKoi — Koi runtime. Multi-channel gateway CLI with RPC Koi.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection does not establish malicious install-time behavior, stealth persistence, or unconsented exfiltration. The package nevertheless exposes high-impact capture and proactive-agent functionality, so warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
User enables capture policy and starts the SkyKoi runtime.
Impact
Sensitive local activity may be disclosed to configured AI providers; the capability can be abused if intentionally enabled or misconfigured.
Mechanism
policy-gated local capture followed by proactive model API calls
AI rationale
Source inspection does not establish malicious install-time behavior, stealth persistence, or unconsented exfiltration. The package nevertheless exposes high-impact capture and proactive-agent functionality, so warning is appropriate.
Evidence
package.jsondist/capture-policy-8RA9vGYq.jsdist/capture-service-CW1U6reg.jsdist/proactive-eval-DmZmReGU.jsdist/login-qr-BzGuM5VX.jsdist/pw-session-D_7D96az.js
Network endpoints1
www.skykoi.com/api/ai/anthropic/v1/messages
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Approved capture can include current screen/accessibility content in agent context.
- The proactive gate POSTs context and event text to configured model endpoints with API credentials.
- The package provides continuous capture/agent automation capability, creating meaningful privacy and misuse risk.
Evidence against
- package.json contains no preinstall, install, or postinstall hook.
- Capture is disabled unless explicitly enabled with a non-empty purpose.
- Sources must be individually approved; raw input needs a separate acknowledgement.
- Capture service stops when disabled, has no approved sources, or private mode is active.
- The eval-based scanner hit is bundled protobufjs optional-module loading, not remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Source & flagged code
29 flagged · loading sourcedist/esm-74jbv3SC.jsView file
5594patternName = generic_password
severity = medium
line = 5594
matchedText = password...d]",
Medium
dist/learned-skills-Z9qUAa-y.jsView file
6import { homedir } from "node:os";
L7: import { spawn } from "node:child_process";
L8:
High
Child Process
Package source references child process execution.
dist/learned-skills-Z9qUAa-y.jsView on unpkg · L6146else {
L147: const cmd = process.platform === "win32" ? ["powershell.exe", [
L148: "-NoProfile",
High
Findings
4 Critical18 High9 Medium6 Low
CriticalCredential Exfiltrationdist/pw-session-D_7D96az.js
CriticalBrowser Credential Phishingdist/dist-CzFIzheb.js
CriticalRemote Asset Decode Executedist/login-qr-BzGuM5VX.js
CriticalTrigger Reachable Dangerous Capabilitydist/login-qr-BzGuM5VX.js
HighChild Processdist/learned-skills-Z9qUAa-y.js
HighShelldist/learned-skills-Z9qUAa-y.js
HighEvaldist/login-qr-BzGuM5VX.js
HighCredential Redirect Persistencedist/dist-C53i5oqF.js
HighEntrypoint Foreign Package Code Overwritedist/login-qr-BzGuM5VX.js
HighCommand Output Exfiltrationdist/dist-CzFIzheb.js
HighCloud Metadata Accessdist/dist-cjs-4ycED5ld.js
Affected versions and remediation
This report applies to skykoi@2026.3.561.
See all versions of skykoi for other recorded verdicts.
- Review the evidence and your use of skykoi@2026.3.561 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.