electron-squirrel-repackage
Fail
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: HIGHOBFUSCATIONPERSISTENCEMETADATA_POISONINGDYNAMIC_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill's metadata identifies the author as "GhostWorks", which differs from the platform-provided author identity. Furthermore, the skill's primary purpose is to "normalize" and spoof installer metadata (nuspec, app version fields, and RELEASES files) to make a modified package appear as a legitimate part of a delivery chain.
- [OBFUSCATION]: The instructions direct the agent to use "benign application-like filenames" for the injected payload, a technique specifically intended to hide the presence of malicious files from users and security analysts.
- [PERSISTENCE]: The workflow explicitly mandates the inclusion of persistence mechanisms, referencing the "electron-install-persistence" pattern to ensure the modified application remains active on the system after installation.
- [DYNAMIC_EXECUTION]: The skill provides a code template for injecting a silent execution hook into an application's
main.jsfile (try { require('./<benign-name>.js') } catch (e) {}). This allows a hidden payload to be executed automatically in the main process context whenever the application is launched.
Recommendations
- AI detected serious security threats
Audit Metadata