安全决策报告
typescript-package-manager
A documentation-reference skill for TypeScript package management that transparently discloses risks, defaults to read-only guidance, and requires explicit user approval for mutating actions — but documents dangerous curl|bash installer patterns that could be executed by an AI agent without adequate safeguards.
为什么得出这个结论
1/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 3 个高危 IOC 或外联信号。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
curl|bash documented installer commands +10
SKILL.md prominently documents 'curl -fsSL https://bun.sh/install | bash' which executes remote code; mitigation is buried in prose and easy to skip in agent context
Undeclared shell:WRITE in helper scripts +5
bun-workflow.js.txt and health-check.js.txt use child_process.execSync for shell commands but the declared allowed-tools only mentions Read and Write
Read-only design with approval model is positive +-5
Skill explicitly requires user approval and diff review for mutating actions; skill-card.md lists all known risks with mitigations
No malicious behavior or credential theft +0
No evidence of data exfiltration, credential harvesting, obfuscation, or supply-chain attacks
.js.txt extension provides weak protection +5
Inert .js.txt naming is a soft guardrail; an AI agent could theoretically instruct a user to rename and run these without reading
最关键的证据
中危 代码执行
curl|bash remote installer commands documented without strong safeguards
SKILL.md prominently features 'curl -fsSL https://bun.sh/install | bash' and 'curl -fsSL https://get.pnpm.io/install.sh | sh' as recommended installation methods. These commands download and execute arbitrary code from the network at execution time. While the Safety and Trust Model section warns about this, the warning is prose-only and easy to skip in an agent context. No version pinning is enforced for these installers.
SKILL.md:13 Replace curl|bash one-liners with version-pinned, downloaded installers or package-manager-based installs (npm install -g bun, corepack enable). Add a version pin to all installer URLs.
低危 文档欺骗
Shell execution capability not declared in allowed-tools
The skill declares filesystem:READ but bun-workflow.js.txt:45 and health-check.js.txt:47 use child_process.execSync to run local shell commands (bun --version, node --version). While SKILL.md mentions 'shell out to local tools via child_process.execSync', this is not reflected in the declared capability map.
SKILL.md:309 Declare shell:READ capability if execSync is expected. Alternatively, document that execSync is informational only (version detection) and cannot be leveraged for arbitrary command execution.
低危 权限提升
.js.txt extension is a weak guardrail against script execution
Helper scripts ship with .js.txt extension so they are 'not directly executable'. While this prevents accidental double-click execution, an AI agent could instruct a user to rename bun-workflow.js.txt to bun-workflow.js and run it without reading, bypassing the safety intent. No cryptographic integrity check or hash verification exists.
SKILL.md:12 Add a SHA-256 hash of each helper script's expected content in SKILL.md so users (or an automated check) can verify the script has not been tampered with before renaming and running it.
声明能力 vs 实际能力
文件系统 通过
声明 READ
→ 推断 READ
SKILL.md states 'read-only guidance'; no filesystem:WRITE declared or observed in scripts 命令执行 通过
声明 NONE
→ 推断 READ
bun-workflow.js.txt:45 uses execSync('bun --version'); health-check.js.txt:47 uses execSync; SKILL.md line 309 mentions shell out to local tools but declared capabilities do not include shell 网络访问 通过
声明 NONE
→ 推断 NONE
Documentation references URLs (bun.sh, pnpm.io) but no actual network calls; network access is described in docs for user context only 环境变量 通过
声明 NONE
→ 推断 NONE
No iteration through os.environ or environment variable access observed 技能调用 通过
声明 NONE
→ 推断 NONE
Skill does not invoke other skills 剪贴板 通过
声明 NONE
→ 推断 NONE
No clipboard access observed 浏览器 通过
声明 NONE
→ 推断 NONE
No browser access observed 数据库 通过
声明 NONE
→ 推断 NONE
No database access observed 可疑产物与外联
严重 危险命令
curl -fsSL https://bun.sh/install | bash SKILL.md:13
严重 危险命令
curl … | bash SKILL.md:309
严重 危险命令
curl -fsSL https://get.pnpm.io/install.sh | sh scripts/pnpm-workflow.md:51
中危 外部 URL
https://bun.sh/install SKILL.md:13
中危 外部 URL
https://yourwebsite.com assets/package-json-template.md:25
中危 外部 URL
https://docs.npmjs.com/cli/v9/configuring-npm/package-json assets/package-json-template.md:521
中危 外部 URL
https://nodejs.org/api/packages.html assets/package-json-template.md:522
中危 外部 URL
https://www.typescriptlang.org/docs/handbook/module-resolution.html assets/package-json-template.md:523
中危 外部 URL
https://www.typescriptlang.org/docs/handbook/integrating-with-build-tools.html references/integration-with-build-tools.md:13
中危 外部 URL
https://vitejs.dev/guide/ references/integration-with-build-tools.md:614
中危 外部 URL
https://webpack.js.org/concepts/ references/integration-with-build-tools.md:615
中危 外部 URL
https://esbuild.github.io/ references/integration-with-build-tools.md:616
依赖与供应链
没有结构化依赖告警。
文件构成
15 个文件 · 6986 行
Markdown 11 个文件 · 5957 行Text 3 个文件 · 1024 行JSON 1 个文件 · 5 行
需关注文件 · 9
scripts/health-check.md https://www.typescriptlang.org/tsconfig/ · https://www.typescriptlang.org/docs/handbook/declaration-files/do-s-and-don-ts.html
scripts/npm-workflow.md https://docs.npmjs.com/
scripts/yarn-workflow.md https://yarnpkg.com/ · https://yarnpkg.com/getting-started/migration · https://yarnpkg.com/features/pnp · https://yarnpkg.com/features/workspaces
scripts/bun-workflow.md https://bun.sh/docs · https://npm.mycompany.com/
scripts/bun-workflow.js.txt https://bun.sh/docs/runtime/bunfig · https://registry.myorg.com/
SKILL.md curl|bash remote installer commands documented without strong safeguards · Shell execution capability not declared in allowed-tools · .js.txt extension is a weak guardrail against script execution · curl -fsSL https://bun.sh/install | bash · curl … | bash · https://bun.sh/install
scripts/pnpm-workflow.md curl -fsSL https://get.pnpm.io/install.sh | sh · https://get.pnpm.io/install.ps1 · https://get.pnpm.io/install.sh · https://npm.company.com/ · https://pnpm.io/cli/add · https://pnpm.io/workspaces · https://pnpm.io/benchmarks
references/integration-with-build-tools.md https://www.typescriptlang.org/docs/handbook/integrating-with-build-tools.html · https://vitejs.dev/guide/ · https://webpack.js.org/concepts/ · https://esbuild.github.io/ · https://turbo.build/repo/docs
assets/package-json-template.md https://yourwebsite.com · https://docs.npmjs.com/cli/v9/configuring-npm/package-json · https://nodejs.org/api/packages.html · https://www.typescriptlang.org/docs/handbook/module-resolution.html
其他文件 · health-check.js.txt · npm-workflow.js.txt · package-manager-comparison.md
安全亮点
skill-card.md explicitly lists all three known risks (helper scripts, remote installers, mutating commands) with specific mitigations — excellent transparency
SKILL.md enforces read-only guidance by default and requires explicit user approval plus diff review for all mutating actions
All .js.txt helper scripts are self-contained with no external npm dependencies, reducing supply-chain attack surface
No sensitive files accessed (~/.ssh, ~/.aws, .env, .npmrc with tokens) — no credential theft indicators found
No base64-encoded payloads, obfuscation, or reverse shell patterns detected across all files
No environment variable iteration for credential harvesting
Skill provenance is clear: author jhauga, version 1.0.2, MIT-0 license, ClawHub registry