wittyhub@0.0.5
The open agent skills ecosystem
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI’s GitHub credential use is limited to requests to GitHub’s own API, but its default runtime telemetry includes repository sources and skill file paths while being described as anonymous usage telemetry. This is suspicious telemetry, not evidence of credential theft or malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI operation that calls track, such as installing a skill.
Impact
The service may learn which repositories and skills the user works with; this exceeds anonymous usage metrics and creates a privacy risk.
Mechanism
The CLI adds repository source, skill names, agent targets and skill file paths to telemetry sent to the SkillHub API. Telemetry can be disabled with documented environment variables.
AI rationale
The CLI’s GitHub credential use is limited to requests to GitHub’s own API, but its default runtime telemetry includes repository sources and skill file paths while being described as anonymous usage telemetry. This is suspicious telemetry, not evidence of credential theft or malicious behavior.
Evidence
dist/cli.mjsREADME.md
Network endpoints1
skillhub.openeuler.org/api/v1/skills/telemetry
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry sends install source repositories, selected skill names, agent targets and skill file paths to the package service.
- Telemetry is enabled by default; the README describes it as anonymous usage telemetry and documents opt-out variables.
- The CLI uses a GitHub token only for repository-tree requests to api.github.com after an anonymous request is rate-limited.
Evidence against
- The package is a CLI for discovering and installing agent skills, and its executable entry point matches that purpose.
- The GitHub token flow targets api.github.com, its own service, rather than the unrelated hosts flagged by the scanner.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
3 flaggeddist/_chunks/libs/simple-git.mjsView file
5import { Buffer as Buffer$1 } from "node:buffer";
L6: import { spawn } from "child_process";
L7: import { EventEmitter } from "node:events";
High
Child Process
Package source references child process execution.
dist/_chunks/libs/simple-git.mjsView on unpkg · L5dist/cli.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = wittyhub@0.0.1
matchedIdentity = npm:d2l0dHlodWI:0.0.1
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.mjsView on unpkg13Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution.
L13: import { createHash } from "node:crypto";
L14: import { execFile } from "node:child_process";
L15: import { promisify, stripVTControlCharacters } from "node:util";
...
L27: import { createHash as createHash$1 } from "crypto";
L28: import { gunzipSync, inflateRawSync } from "node:zlib";
L29: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
...
L46: }
L47: if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
L48: try {
...
L261: const cliConfig = loadCliConfig();
L262: const API_URL = typeof cliConfig.api_url === "string" && cliConfig.api_url.trim() ? cliConfig.api_url.trim().rep
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.mjs
HighChild Processdist/_chunks/libs/simple-git.mjs
HighShell
HighCross File Remote Execution Contextdist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to wittyhub@0.0.5.
See all versions of wittyhub for other recorded verdicts.
- Review the evidence and your use of wittyhub@0.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.