False positive: GHSA-9wgc-5pgr-25p3 / MAL-2026-18220 (npm "skillward") is a security scanner, not malware #10534

Hi, I'm the author and maintainer of skillward. I'm asking you to withdraw
GHSA-9wgc-5pgr-25p3 (OSV MAL-2026-18220, "Malware in skillward", published 2026-10-23), which covers npm versions
0.1.1 and 0.1.2. Both versions were removed from npm.

What the package is. skillward is an open-source (MIT) static scanner for AI-agent configuration: SKILL.md,
CLAUDE.md, AGENTS.md, MCP configs and Claude Code hooks. It reads files and reports dangerous patterns in them. It
never executes, imports or downloads what it scans and makes no network requests.

Why it was probably flagged. Its detection rules contain the patterns it looks for, as strings and regular
expressions: curl … | sh, powershell -enc, credential paths such as ~/.ssh/id_rsa and ~/.aws/credentials,
reverse-shell shapes, and indicators of the ClawHavoc skill campaign. A heuristic looking for these strings would
match the scanner itself. None of them is executed: they are data for matching.

The published code is the public source, byte for byte.

• 0.1.2 was published from tag v0.1.2 (commit bdadd0fda887df6ae4a0abae97e63f570825e8a7)
  by GitHub Actions with npm trusted publishing and provenance:
  • workflow run: https://github.com/antshkvr/skillward/actions/runs/39962477029
  • tarball shasum f7b469fe2e9b51234e693f37b2a9d6252f32137d, integrity sha512-NTeUkO6oAoJjOhdwfRM/OpvAQEB5KK1YIQWQlImsF5b8AIfWNtPTrPWuii6o5ggAqo+jPMw7luIcHIpetjGptg==
  • provenance in the Sigstore transparency log: https://search.sigstore.dev/?logIndex=3420369342
• I rebuilt tag v0.1.2 (npm ci && npm run build) and compared it with the published tarball: all 48 files in
  dist/ are identical, as are README.md, CHANGELOG.md and LICENSE.
• 0.1.1 was published from tag v0.1.1 (commit 2a185cc866bd5c3544aac0358afd6d609dcb2fda)
  with npm publish from my own machine, before trusted publishing was set up, so it has no provenance attestation.
  It was built from that tag the same way. Between 0.1.1 and 0.1.2 only 4 files in src/ and package.json changed
  (+10 / −13 lines, git diff v0.1.1 v0.1.2 -- src package.json), described in
  CHANGELOG.md.

What the published code does and doesn't do (0.1.2 tarball, dist/):

• Node built-ins imported: only node:fs, node:fs/promises, node:path, node:os, node:url, node:crypto
  (hashing for the lockfile). No http, https, net, tls, dns, child_process, worker_threads or vm; no
  fetch, eval or new Function. The only occurrences of eval( and XMLHttpRequest are inside detection regexes
  (dist/parsers/script-shape.js, dist/rules/SW015-dangerous-script.js).
• No install-time scripts: there is no preinstall, install or postinstall; the only lifecycle script is
  prepublishOnly (lint, test, build), which never runs on a user's machine.
• Runtime dependencies: commander, diff, ignore, picocolors, yaml.

How to check this yourself:

git clone https://github.com/antshkvr/skillward && cd skillward && git checkout v0.1.2
npm ci && npm run build
# compare dist/ with the 0.1.2 tarball you hold (shasum f7b469fe…)
grep -rnE "node:(http|https|net|tls|dns|child_process|worker_threads|vm)|fetch\(|new Function" dist/

I have also contacted npm support about the package (2026-10-23). I'm happy to answer any questions or provide
anything else you need. If something specific in the package triggered the report, please tell me and I'll change it.

Thank you.