📦
Audit-Verlauf
k-skill-setup - 1 Audit
Audit-Version 1 Neueste
8. Nov. 2026, 14:42
Most static detections are benign documentation, restricted credential-file setup, or metadata checks; no evidence found of credential exfiltration or concealed malware. Global updates and scheduled execution of mutable npm packages retain genuine supply-chain and persistence risks despite consent requirements. Separately, the adapter promotes remotely fetched CLI output to primary instructions without binding it to the reviewed source.
4
Gescannte Dateien
301
Analysierte Zeilen
10
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Windows scheduled task creation
schtasks /Create /SC DAILY /TN "k-skill-update-check" /TR "\"$HOME/.config/k-skill/bin/check-skill-u
schtasks creates a daily persistent task whose helper executes an unpinned npm package. Explicit opt-in reduces authorization concerns but not supply-chain exposure.
Hoch
Mutable Remote Instructions Cross the Audit Trust Boundary
The adapter says, "follow its output as the primary instructions for this skill," then executes @nomadamas/k-skill@0 through npx. This mutable major-version selector can supply executable code and replacement instructions not bound to the reviewed source. No evidence found of a malicious package payload; the risk is unverified upstream authority over later agent behavior.
The adapter explicitly delegates primary instructions to CLI output and selects a major version rather than an immutable artifact. The CLI implementation is not included.
Elemente der Fähigkeitsprüfung (4)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
Hidden file in home directory
`update`는 CLI가 뒤처져 있으면 갱신하고, `npx --yes skills add NomaDamas/k-skill --all -g` 로 Vercel Agent Skills
The update operation replaces global skills across coding agents using mutable upstream sources. This can change executable instructions beyond the current skill.
Hoch
Hidden file access
`update`는 CLI가 뒤처져 있으면 갱신하고, `npx --yes skills add NomaDamas/k-skill --all -g` 로 Vercel Agent Skills
The documented update changes global agent skill installations, including ~/.agents/skills, from mutable upstream sources. The security concern is broad replacement of trusted agent instructions.
Mittel
Hidden file access
(crontab -l 2>/dev/null; echo "0 9 * * * $HOME/.config/k-skill/bin/check-skill-updates.sh") | cronta
The cron entry persists daily execution of a helper that runs unpinned npx --yes skills check. Consent does not eliminate mutable-package execution risk.
Mittel
Hidden file access
schtasks /Create /SC DAILY /TN "k-skill-update-check" /TR "\"$HOME/.config/k-skill/bin/check-skill-u
The command registers persistent daily execution of a helper that invokes an unpinned npm package. The named task is optional but retains supply-chain risk.
Risikofaktoren
⚙️ Externe Befehle (8)
🌐 Netzwerkzugriff (2)
📁 Dateisystemzugriff (33)
instruction.md:11 instruction.md:60 instruction.md:86 instruction.md:98 instruction.md:99 instruction.md:100 instruction.md:173 instruction.md:174 instruction.md:184 instruction.md:11 instruction.md:60 instruction.md:86 instruction.md:98 instruction.md:99 instruction.md:100 instruction.md:173 instruction.md:174 instruction.md:177 instruction.md:182 instruction.md:184 instruction.md:185 instruction.md:191 instruction.md:192 instruction.md:194 instruction.md:195 instruction.md:196 instruction.md:185 scripts/check-setup.sh:22 scripts/check-setup.sh:23 scripts/check-setup.sh:4 scripts/check-setup.sh:22 scripts/check-setup.sh:23 scripts/check-setup.sh:12
🔑 Umgebungsvariablen (4)
Erkannte Muster
Windows scheduled task creation
Geprüft von: codex