wittyhub@0.0.7
The open agent skills ecosystem
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe flagged process execution and file writes are part of the user-invoked skills CLI, while the prepare hook only invokes Husky. Telemetry is sent to the package's skills API and can be disabled through environment settings; no concrete malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the CLI, including a skill installation command.
Impact
No confirmed attack surface was established from the inspected source.
Mechanism
The CLI sends installation metadata to its skills API and flushes pending telemetry at exit; it does not run this behavior from an install hook.
AI rationale
The flagged process execution and file writes are part of the user-invoked skills CLI, while the prepare hook only invokes Husky. Telemetry is sent to the package's skills API and can be disabled through environment settings; no concrete malicious behavior was identified.
Network endpoints1
skillhub.openeuler.org/api/v1
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and its prepare hook only runs Husky; its runtime imports a YAML parser for CLI use.
- The CLI sends opt-out-controlled telemetry to its skills API during skill installation, with installation metadata, then flushes telemetry when the CLI exits.
- The bundled YAML files implement parsing and serialization helpers; the simple-git chunk is imported by the CLI.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
3 flaggeddist/_chunks/libs/simple-git.mjsView file
6import { normalize } from "node:path";
L7: import { spawn } from "child_process";
L8: import { EventEmitter } from "node:events";
High
Child Process
Package source references child process execution.
dist/_chunks/libs/simple-git.mjsView on unpkg · L6dist/cli.mjsView file
11Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution.
L11: import { createHash } from "node:crypto";
L12: import { execFile } from "node:child_process";
L13: import { promisify, stripVTControlCharacters } from "node:util";
...
L25: import { createHash as createHash$1 } from "crypto";
L26: import { gunzipSync, inflateRawSync } from "node:zlib";
L27: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
...
L44: }
L45: if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
L46: try {
...
L260: const cliConfig = loadCliConfig();
L261: const API_URL = typeof cliConfig.api_url === "string" && cliConfig.api_url.trim() ? cliConfig.api_url.trim().rep
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
Findings
3 High3 Medium6 Low
HighChild Processdist/_chunks/libs/simple-git.mjs
HighShell
HighCross File Remote Execution Contextdist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to wittyhub@0.0.7.
See all versions of wittyhub for other recorded verdicts.
- Review the evidence and your use of wittyhub@0.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.