T03 · Remote Payload Retrieval and Execution
Error
- Location
examples.py:91- Finding
Unverified Remote Installer Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Vibe Codebase Audit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed security-audit tool, but its remote audit, cache, and setup examples create meaningful data-exposure and execution risks users should review before installing.
Install only if you understand these limits: avoid the curl-to-shell Ollama command, run the local scanner on a narrow trusted project path, do not use remote or multi-model modes on private repositories unless you have reviewed what will be sent, and disable enhanced caching or avoid the enhanced auditor until the pickle cache and fail-open SAFE summary are fixed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
vibe_audit_tools.py:330- Finding
Whole-Project Source and Sensitive Files Can Be Sent to OpenRouter
- Content
View full analysis
dict: """Read all text files from the project.""" project = Path(project_path) files_content = {} if not project.exists(): return {"error": f"Project path '{project_path}' does not exist"} for file_path in project.rglob('*'): if file_path.is_file() and not any(part.startswith('.git') for part in file_path.parts): if file_path.stat().st_size > max_file_size: continue try: with open(file_path, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() if '\0' not in content: rel_path = str(file_path.relative_to(project)) files_content[rel_path] = content except: continue return files_content ``` The collected contents are inserted into the LLM prompt: ```python full_content = "" for path, content in files_content.items(): full_content += f"\n{'='*80}\n" full_content += f"FILE: {path}\n" full_content += f"{'='*80}\n" full_content += content full_content += "\n" ``` The complete prompt is then transmitted to OpenRouter: ```python response = requests.post( "https://openrouter.ai/api/v1/chat/completions", headers={ "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" }, json={ "model": model, "messages": [ { "role": "user", "content": prompt } ...[truncated 2692 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
vibe_audit_enhanced.py:99- Finding
Unsafe Pickle Deserialization from a Project-Relative Cache
- Content
View full analysis
Optional[Dict]: """Get cached audit result""" file_hash = self._get_file_hash(file_path) cache_key = str(file_path.absolute()) if cache_key in self.index: cached = self.index[cache_key] if cached['hash'] == file_hash: cache_time = datetime.fromisoformat(cached['timestamp']) if datetime.now() - cache_time < timedelta(days=self.expire_days): cache_file = self.cache_dir / cached['cache_file'] if cache_file.exists(): try: with open(cache_file, 'rb') as f: return pickle.load(f) except: pass ``` The cache is enabled by default and uses a relative directory: ```python cache_enabled: bool = True cache_dir: str = ".vibe-audit-cache" ``` ### Technical Analysis Python pickle is an executable object serialization format. Deserializing an untrusted pickle can invoke attacker-selected callables through reduction opcodes. `pickle.load` must therefore only process authenticated data from a trusted source. The cache directory is relative to the process working directory and the cache index has no signature, message authentication code, ownership check, or trusted-path enforcement. If an attacker can place or alter `.vibe-audit-cache/index.json` and the referenced cache file, the auditor may deserialize attacker-controlled data. The file hash check does not authenticate the cache. An attacker preparing a repository can calculate the hash of a repository file and insert that value in the cache index. The attacker can also provide a recent timestamp and a malicious pickle filename. ### Attack Path 1. An attacker prepare ...[truncated 1266 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
vibe_audit_enhanced.py:626- Finding
Enhanced Auditor Returns a Hard-Coded SAFE Result Without Performing File Analysis
- Content
View full analysis
Dict: """Audit file without cache""" # This would use the LLM provider pool # For now, return a placeholder return { "file": str(file_path), "findings": [], "timestamp": datetime.now().isoformat() } ``` The parallel audit also reports every collected file as audited while returning no findings: ```python async def _audit_files_parallel(self, files: List[Path]) -> Dict: """Audit multiple files in parallel""" # Implementation would use the provider pool return { "total_files": len(files), "audited": len(files), "findings": [] } ``` The summary ignores scanner results and unconditionally reports a safe result: ```python def _generate_summary(self, results: List) -> Dict: """Generate audit summary""" total_findings = 0 by_severity = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0} for result in results: if isinstance(result, dict): # Count findings pass return { "total_findings": total_findings, "by_severity": by_severity, "risk_score": 0, "risk_level": "SAFE" } ``` ### Technical Analysis The enhanced auditor presents itself as a complete project security audit, but it does not analyze file contents. `_audit_files_parallel` reports all files as audited even though no per-file audit occurs. `_generate_summary` does not aggregate dependency or configuration findings and instead returns a constant zero score and `SAFE` status. This is a fail-open design: missing implementation, provider failures, scanner e ...[truncated 1376 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (95)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## 🎯 Next Steps 1. ✅ Create 8-language README files 2. ✅ Update SKILL.md with multi-language links 3. ✅ Verify all translations 4. ✅ Publish updated version (v2.0.1)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The README instructs users to pipe a remotely fetched script directly into a shell, which creates a classic supply-chain and remote code execution risk. If the remote server, transport path, or script content is compromised, users may execute arbitrary code immediately with their shell privileges.
- Content
Ollama (Lokal, Kostenlos)
bash # Ollama installieren curl -fsSL https://ollama.com/install.sh | sh # Modell herunterladen ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The explicit use of shell piping ('| sh') compounds the danger by immediately executing untrusted network content without validation or user review. In README context this is especially risky because users are likely to copy-paste commands verbatim, turning documentation into an execution vector.
- Content
Ollama (Lokal, Kostenlos)
bash # Ollama installieren curl -fsSL https://ollama.com/install.sh | sh # Modell herunterladen ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The README recommends installing software via 'curl ... | sh', which executes a remotely fetched script without prior verification. If the upstream host, network path, or DNS/TLS trust chain is compromised, users could execute arbitrary attacker-controlled code on their machine.
- Content
Ollama (Local, Free)
bash # Install Ollama curl -fsSL https://ollama.com/install.sh | sh # Pull model ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Piping downloaded content directly into 'sh' creates an unsafe command chain that removes the opportunity for validation and increases the blast radius of any compromise. In agent or copy-paste workflows, this pattern is especially risky because users may run it reflexively, leading to immediate remote code execution.
- Content
Ollama (Local, Free)
bash # Install Ollama curl -fsSL https://ollama.com/install.sh | sh # Pull model ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The command 'curl -fsSL https://ollama.com/install.sh | sh' fetches executable content from the network and immediately runs it without review or verification. If the remote host, connection path, or script distribution channel is compromised, users could execute arbitrary code on their systems.
- Content
Ollama (Local, Gratis)
bash # Instalar Ollama curl -fsSL https://ollama.com/install.sh | sh # Descargar modelo ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The '| sh' pattern is dangerous because it chains untrusted network output directly into a shell, eliminating any opportunity for inspection and magnifying the risk of command injection or malicious script execution. In a README for a security auditing tool, this is especially concerning because it encourages unsafe trust behavior in a security-sensitive context.
- Content
Ollama (Local, Gratis)
bash # Instalar Ollama curl -fsSL https://ollama.com/install.sh | sh # Descargar modelo ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation recommends executing a remote install script directly from the network via 'curl ... | sh', which can lead to arbitrary code execution if the remote server, CDN, DNS, TLS trust chain, or distribution path is compromised. In an agent skill context, users may copy-paste commands with elevated trust, increasing the likelihood of unsafe execution.
- Content
Ollama (Local, Gratuit)
bash # Installer Ollama curl -fsSL https://ollama.com/install.sh | sh # Télécharger le modèle ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping remote content directly into 'sh' creates an immediate execution chain with no review boundary, making any compromise of the fetched content result in shell command execution. This is especially risky in documentation because it normalizes a hazardous operational pattern for end users.
- Content
Ollama (Local, Gratuit)
bash # Installer Ollama curl -fsSL https://ollama.com/install.sh | sh # Télécharger le modèle ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The README instructs users to execute a remote installer directly via
curl ... | sh, which runs network-fetched code without prior inspection or integrity verification. If the remote host, transport, DNS, or installer content is compromised, users could execute arbitrary shell commands on their system.- Content
Ollama（ローカル、無料）
bash # Ollamaをインストール curl -fsSL https://ollama.com/install.sh | sh # モデルをプル ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| shconstruct is the dangerous execution step that turns a remote download into immediate command execution, removing the user's opportunity to inspect what will run. In an agent/tooling context, examples like this are especially risky because users may copy-paste them verbatim into privileged shells.- Content
Ollama（ローカル、無料）
bash # Ollamaをインストール curl -fsSL https://ollama.com/install.sh | sh # モデルをプル ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The documentation instructs users to fetch and immediately execute a remote shell script via curl piped to sh. This pattern is dangerous because any compromise of the remote host, CDN, DNS, TLS trust chain, or served script content results in arbitrary code execution on the user's machine.
- Content
Ollama (로컬, 무료)
bash # Ollama 설치 curl -fsSL https://ollama.com/install.sh | sh # 모델 다운로드 ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The use of a shell pipe into sh removes the user's opportunity to inspect the downloaded content before execution and is a classic command-chaining antipattern. In a README for an AI agent skill, such examples are more dangerous because users may copy-paste them directly, leading to immediate arbitrary code execution if the upstream content is altered.
- Content
Ollama (로컬, 무료)
bash # Ollama 설치 curl -fsSL https://ollama.com/install.sh | sh # 모델 다운로드 ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation instructs users to execute a remote install script directly via 'curl ... | sh', which bypasses normal verification and gives network-delivered code immediate shell execution. If the remote host, transport, or script supply chain is compromised, users can suffer arbitrary code execution on their systems.
- Content
Ollama (Local, Grátis)
bash # Instalar Ollama curl -fsSL https://ollama.com/install.sh | sh # Baixar modelo ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping fetched network content directly into 'sh' is a classic command-chaining abuse pattern because it eliminates review boundaries between download and execution. In skill documentation, this is especially risky because users may copy-paste it verbatim, turning the README into a code-execution vector if the upstream content changes or is maliciously modified.
- Content
Ollama (Local, Grátis)
bash # Instalar Ollama curl -fsSL https://ollama.com/install.sh | sh # Baixar modelo ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The README recommends piping a remotely fetched script directly into a shell via 'curl ... | sh'. This is dangerous because it executes unverified code from the network immediately, allowing server compromise, CDN compromise, MITM in weakened environments, or supply-chain attacks to result in arbitrary code execution on the user's machine. In a developer-facing skill README, this is more dangerous because users may copy-paste it verbatim during setup.
- Content
Ollama (Local, Free)
bash # Install Ollama curl -fsSL https://ollama.com/install.sh | sh # Pull model ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The shell pipe into 'sh' is a classic chaining pattern that turns a network fetch into immediate command execution. This creates a one-step remote code execution path if the fetched content is malicious or tampered with, and the risk is amplified in setup documentation because it encourages blind execution by readers. The skill context does not justify this pattern; it is unrelated to the audit functionality and represents unsafe installation guidance.
- Content
Ollama (Local, Free)
bash # Install Ollama curl -fsSL https://ollama.com/install.sh | sh # Pull model ollama pull llama2
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
文档直接建议用户执行“curl ... | sh”从远程站点获取并立刻执行脚本，这会把代码执行信任完全交给网络传输链路和远端内容。一旦安装脚本被篡改、站点受损、DNS/代理遭劫持，用户可能在本机执行任意命令，造成系统沦陷或凭据泄露。
- Content
Ollama（本地，免费）
bash # 安装 Ollama curl -fsSL https://ollama.com/install.sh | sh # 拉取模型 ollama pull llama2
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
“| sh”将外部获取的内容直接送入 shell 执行，属于典型的命令链式滥用模式。在面向智能体/开发工作流的技能文档中，这种一步执行命令更危险，因为用户或自动化流程可能不加审查地复制运行，扩大供应链攻击和远程代码执行风险。
- Content
Ollama（本地，免费）
bash # 安装 Ollama curl -fsSL https://ollama.com/install.sh | sh # 拉取模型 ollama pull llama2
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Support for npm, pip, maven, cargo, go mod ### ⚙️ Configuration Security Checks - Exposed .env file detection - CORS misconfiguration detection - Authentication configuration review - Debug mode detection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Support for npm, pip, maven, cargo, go mod ### ⚙️ Configuration Security Checks - Exposed .env file detection - CORS misconfiguration detection - Authentication configuration review - Debug mode detection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Support for npm, pip, maven, cargo, go mod ### ⚙️ Configuration Security Checks - Exposed .env file detection - CORS misconfiguration detection - Authentication configuration review - Debug mode detection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Support for npm, pip, maven, cargo, go mod ### ⚙️ Configuration Security Checks - Exposed .env file detection - CORS misconfiguration detection - Authentication configuration review - Debug mode detection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Support for npm, pip, maven, cargo, go mod ### ⚙️ Configuration Security Checks - Exposed .env file detection - CORS misconfiguration detection - Authentication configuration review - Debug mode detection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Support for npm, pip, maven, cargo, go mod ### ⚙️ Configuration Security Checks - Exposed .env file detection - CORS misconfiguration detection - Authentication configuration review - Debug mode detection
Static analysis
No suspicious patterns detected.