wittyhub@0.0.1
The open agent skills ecosystem
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows risky primitives are aligned with the advertised CLI workflow and are activated by explicit user commands, not install/import-time compromise. No concrete malicious behavior or unconsented broad AI-agent control-surface mutation was found.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs wittyhub/add-skill CLI commands such as add, find, sync, update, remove, or use.
Impact
Installs user-selected agent skills; no unconsented lifecycle mutation or exfiltration confirmed.
Mechanism
Prompted CLI skill discovery/install/update with git/fetch and sanitized file copy/symlink operations
AI rationale
Static inspection shows risky primitives are aligned with the advertised CLI workflow and are activated by explicit user commands, not install/import-time compromise. No concrete malicious behavior or unconsented broad AI-agent control-surface mutation was found.
Evidence
package.jsonbin/cli.mjsdist/cli.mjsREADME.md
Network endpoints5
api.github.comraw.githubusercontent.comskills.shadd-skill.vercel.sh/tadd-skill.vercel.sh/audit
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- CLI can install downloaded SKILL.md content into many agent skill directories when user runs add/sync.
- dist/cli.mjs sends opt-out telemetry/audit requests to add-skill.vercel.sh during user commands.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare only runs husky for development/git installs.
- bin/cli.mjs only enables Node compile cache then imports dist/cli.mjs.
- dist/cli.mjs network use is package-aligned: GitHub/git hosts, skills.sh download/search, audit/telemetry endpoints.
- Child process use is for git/gh cloning and explicitly requested agent launch/update commands.
- Skill writes are user-invoked, prompted or gated by -y/--all, and path-sanitized before copying/symlinking.
- No credential harvesting, import-time execution beyond CLI startup, persistence hooks, destructive lifecycle behavior, or prompt injection found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
2 flaggeddist/_chunks/libs/simple-git.mjsView file
4import { Buffer as Buffer$1 } from "node:buffer";
L5: import { spawn } from "child_process";
L6: import { normalize } from "node:path";
High
Child Process
Package source references child process execution.
dist/_chunks/libs/simple-git.mjsView on unpkg · L4dist/cli.mjsView file
18Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution.
L18: import { promisify } from "util";
L19: import { execFile, execSync, spawn, spawnSync } from "child_process";
L20: import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
...
L22: import { createHash as createHash$1 } from "crypto";
L23: import { gunzipSync, inflateRawSync } from "node:zlib";
L24: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
...
L41: }
L42: if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
L43: try {
...
L57: }
L58: async function isRepoPrivate(owner, repo) {
L59: try {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
Findings
3 High3 Medium5 Low
HighChild Processdist/_chunks/libs/simple-git.mjs
HighShell
HighCross File Remote Execution Contextdist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wittyhub@0.0.1.
See all versions of wittyhub for other recorded verdicts.
- Review the evidence and your use of wittyhub@0.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.