Skill Trust Decision
oia-skill
A legitimate project scaffolding tool with well-documented risks; the curl|sh for Deno and npx execution are declared but inherit standard supply-chain risk from third-party packages.
Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
What drove the risk score up
curl|sh from official Deno source +10
Deno installation via deno.land/install.sh is standard practice but still executes arbitrary remote script — risk is documented in skill-card.md
Unpinned npx package execution +5
@oia-ai/oia-fresh@latest fetches and executes third-party npm code without version pinning
Minor: minor declaration gaps +5
SKILL.md documents shell and filesystem access but does not formally declare them as capabilities
Most important evidence
Medium Supply Chain
Unpinned npx package execution
The skill uses 'npx -y @oia-ai/oia-fresh@latest init' which resolves to the latest version at execution time. This allows the published package to change content between executions, potentially introducing malicious code without a manifest change.
SKILL.md:35 Pin to a specific version tag (e.g., @1.2.3) and audit the package content before execution.
Medium RCE
curl|sh remote script execution
The Deno installation command pipes a script downloaded from deno.land directly into sh. While deno.land is the official source, this pattern is inherently dangerous as it executes arbitrary remote code.
SKILL.md:24 Document this as a fallback only; recommend OS package managers (winget, brew, apt) or manual inspection of the script first.
Low Doc Mismatch
Capability declarations not formally listed
SKILL.md describes the standard flow with concrete shell commands but does not include a formal 'allowed-tools' or 'declared-capabilities' section, making it harder to audit scope programmatically.
SKILL.md:1 Add a formal capabilities declaration at the top of SKILL.md for machine-readable auditing.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:21 — deno --version; SKILL.md:24 — curl|sh; SKILL.md:27 — npx --version; SKILL.md:35 — npx init; SKILL.md:47 — deno task dev Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:35 — scaffold writes to user-specified project directory; bin/install.js:27 — copies to .claude/skills/ Network Pass
Declared READ
→ Inferred READ
SKILL.md:39,48 — polls http://127.0.0.1:5173; npm registry for npx fetches Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://deno.land/install.sh | sh SKILL.md:24
Medium External URL
https://deno.land/install.sh SKILL.md:24
Medium External URL
http://127.0.0.1: SKILL.md:39
Medium External URL
http://127.0.0.1:5173/ SKILL.md:48
Medium External URL
https://clawhub.ai/user/pankitgg skill-card.md:9
Medium External URL
https://clawhub.ai/pankitgg/skills/oia-skill skill-card.md:39
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| @oia-ai/oia-fresh | latest (unpinned) | npx | No | No version pin; resolves to latest at execution time — allows silent content changes |
| node:fs | stdlib | node | No | Used only for installing SKILL.md/REAMDE.md to .claude/skills/ |
| node:os | stdlib | node | No | Used only for homedir resolution in install script |
File composition
6 files · 209 lines
Markdown 3 files · 140 linesJSON 2 files · 36 linesJavaScript 1 files · 33 lines
Files of concern · 2
SKILL.md Unpinned npx package execution · curl|sh remote script execution · Capability declarations not formally listed · curl -fsSL https://deno.land/install.sh | sh · https://deno.land/install.sh · http://127.0.0.1: · http://127.0.0.1:5173/
skill-card.md https://clawhub.ai/user/pankitgg · https://clawhub.ai/pankitgg/skills/oia-skill
Other files · install.js · README.md · package.json · _meta.json
Security positives
All high-risk behaviors are documented in skill-card.md under 'Known Risks and Mitigations'
No obfuscation, base64, or hidden execution paths detected
No credential harvesting, environment variable iteration, or sensitive file access
No external data exfiltration or C2 communication — network activity is limited to localhost verification and npm registry
install.js performs only expected file-copy operations using only Node.js stdlib (node:fs, node:os)
Documentation accurately describes all operations performed by the skill
HTTP verification poll targets only localhost, not external IPs