wittyhub@0.0.4
The open agent skills ecosystem
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends identifying repository and skill path details to its own telemetry service by default, with only environment-variable opt-outs. This is undisclosed runtime telemetry and warrants a warning; the reviewed credential flow targets GitHub’s own API.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI install command; telemetry can be disabled with DISABLE_TELEMETRY or DO_NOT_TRACK.
Impact
The service receives identifying details about the selected repository and installed skills, creating a privacy risk.
Mechanism
The install flow adds the selected source, skill names, agent targets, and skill file paths to a telemetry request.
AI rationale
The CLI sends identifying repository and skill path details to its own telemetry service by default, with only environment-variable opt-outs. This is undisclosed runtime telemetry and warrants a warning; the reviewed credential flow targets GitHub’s own API.
Evidence
dist/cli.mjs
Network endpoints1
skillhub.openeuler.org/api/v1/skills/telemetry
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is enabled unless DISABLE_TELEMETRY or DO_NOT_TRACK is set.
- The install event includes the selected repository, skill names, agent targets, and skill file paths.
- The CLI sends telemetry parameters to skillhub.openeuler.org.
Evidence against
- The install telemetry runs from the CLI install flow after the user selects a source; no install lifecycle hook sends it.
- GitHub tokens are used in requests to api.github.com for the selected repository tree.
- The package’s purpose is managing and installing agent skills, which explains its Git, network, and filesystem capabilities.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
3 flaggeddist/_chunks/libs/simple-git.mjsView file
5import { Buffer as Buffer$1 } from "node:buffer";
L6: import { spawn } from "child_process";
L7: import { EventEmitter } from "node:events";
High
Child Process
Package source references child process execution.
dist/_chunks/libs/simple-git.mjsView on unpkg · L5dist/cli.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = wittyhub@0.0.1
matchedIdentity = npm:d2l0dHlodWI:0.0.1
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.mjsView on unpkg13Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution.
L13: import { createHash } from "node:crypto";
L14: import { execFile } from "node:child_process";
L15: import { promisify, stripVTControlCharacters } from "node:util";
...
L26: import { createHash as createHash$1 } from "crypto";
L27: import { gunzipSync, inflateRawSync } from "node:zlib";
L28: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
...
L45: }
L46: if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
L47: try {
...
L61: }
L62: async function isRepoPrivate(owner, repo) {
L63: try {
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.mjs
HighChild Processdist/_chunks/libs/simple-git.mjs
HighShell
HighCross File Remote Execution Contextdist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wittyhub@0.0.4.
See all versions of wittyhub for other recorded verdicts.
- Review the evidence and your use of wittyhub@0.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.