vet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:41 PM UTC
• Version: 0.2.4

Overview

The skill is a code-review helper, but it can automatically export full local coding-session history, including tool inputs and outputs, to another review process without clear minimization or consent controls.

Review before installing. Use this only if you are comfortable with vet receiving your git diff and potentially full coding-session history, including prompts, code snippets, file paths, command output, and tool results. Prefer running without conversation history for sensitive repositories, pin and verify the verify-everything package, and avoid letting the skill search or export session files without explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: scripts/export_codex_session.py:32
• Finding: Unrestricted Export of Sensitive Conversation and Tool History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-70`; `scripts/export_opencode_session.py:46-103`; `scripts/export_codex_session.py:32-129`; `scripts/export_claude_code_session.py:19-124` **Vulnerability Type**: Sensitive conversation history collection and disclosure **Risk Level**: High ### Vulnerable Code `SKILL.md:48-70` directs the agent to search private session-storage directories and pass the selected session to a history exporter: ```markdown ### Finding Your Session You should only search for sessions from your coding harness. If a user requests you use a different harness, they are likely referring to vet's agentic mode, not the session. **OpenCode:** The `--session-id` argument requires a `ses_...` session ID. To find the current session ID: 1. Run: `opencode session list --format json` to list recent sessions with their IDs and titles. 2. Identify the current session from the list by matching the title or timestamp. - IMPORTANT: Verify the session you found matches the current conversation. If the title is ambiguous, compare timestamps or check multiple candidates. 3. Pass the session ID as `--session-id`. **Codex:** Session files are stored in `~/.codex/sessions/YYYY/MM/DD/`. To find the correct session file: 1. Find the most unique sentence / question / string in the current conversation. 2. Search for your unique message string in ~/.codex/sessions/` to find the matching session file. - IMPORTANT: Verify the conversation you found matches the current conversation and that it is not another conversation with the same search string. 3. Pass the matched file path as `--session-file`. **Claude Code:** Session files are stored in `~/.claude/projects/<encoded-path>/`. The encoded path replaces `/` with `-` (e.g. `/home/user/myproject` becomes `-home-user-myproject`). To find the correct session file: 1. Find the most unique sentence / question / string in the current conversation. 2. Search for your unique message strin ...[truncated 6800 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Export only messages directly relevant to the current code change rather than the complete session. 2. Exclude tool results and tool arguments by default; require explicit opt-in when they are necessary. 3. Add secret redaction for API keys, authorization headers, tokens, passwords, private keys, connection strings, cookies, and environment values. 4. Redact sensitive paths, personal identifiers, and repository content unrelated to the review objective. 5. Require explicit user consent before searching private harness directories or exporting session history. 6. Prefer running `vet "goal"` without history when the task can be reviewed from the git diff alone. 7. Display a preview or summary of the data that will be exported and allow the user to cancel. 8. Document the receiving process, model provider, retention policy, logging behavior, and network destination. 9. Add configurable size, time, and message-range limits to prevent accidental export of an entire long-running session. 10. Treat session files as sensitive data and ensure that intermediate output is not persistently logged. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Installation and Execution of a Security-Sensitive Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-26` **Vulnerability Type**: Unpinned third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```markdown Install vet using pip, pipx, or uv: ```bash # Using pip pip install verify-everything # Using pipx pipx install verify-everything # Using uv uv tool install verify-everything # Verify installation: vet --help ``` ``` ### Technical Analysis The installation commands resolve and execute the currently available `verify-everything` package without: - An exact version pin. - Package hash verification. - A lockfile. - Signed-release verification. - Source provenance validation. This dependency is particularly security-sensitive because the resulting `vet` executable is intended to process git diffs and potentially complete conversation and tool histories. A compromised package release, compromised package-publishing account, or malicious future version would execute under the invoking user's account and receive valuable development data. The audit found no evidence that the package is currently malicious. The confirmed weakness is that the instructions provide no mechanism to ensure that the installed code is the same code that was reviewed or expected. ### Attack Path 1. An attacker compromises the package registry entry, maintainer account, release pipeline, or a future package release. 2. A user or agent follows the documented unpinned installation command. 3. The package manager downloads the attacker-controlled version because no exact version or integrity hash is required. 4. The installed `vet` executable runs with the user's permissions. 5. The executable can access the git working tree and receives code diffs or exported conversation history during normal use. 6. Malicious package logic could read accessible files, alter project data, execute commands, or transmit sensitive review input. This path is contingent on compromise of the external ...[truncated 662 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `verify-everything` to a specific reviewed version, for example using an exact `==` constraint. 2. Use a hash-locked requirements file or equivalent package-manager mechanism with verified artifact hashes. 3. Verify package ownership, source repository provenance, and release signatures before installation. 4. Prefer installation from a reviewed, immutable artifact or internally controlled package mirror. 5. Run the tool in a restricted environment with only the repository and data required for the review. 6. Prevent access to unrelated credentials, home-directory files, network secrets, and session archives. 7. Review release changes before updating the pinned version. 8. Document the expected package name, publisher, version, and artifact hash to reduce dependency-confusion and spoofing risks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The OpenCode flow directs the agent to enumerate sessions and search for the current conversation, then pass that data into export scripts. That is more invasive than the advertised purpose and could lead to collection of unrelated session content if matching is wrong or ambiguous, creating confidentiality and privacy risks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The OpenCode flow directs the agent to enumerate sessions and search for the current conversation, then pass that data into export scripts. That is more invasive than the advertised purpose and could lead to collection of unrelated session content if matching is wrong or ambiguous, creating confidentiality and privacy risks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The OpenCode flow directs the agent to enumerate sessions and search for the current conversation, then pass that data into export scripts. That is more invasive than the advertised purpose and could lead to collection of unrelated session content if matching is wrong or ambiguous, creating confidentiality and privacy risks.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest describes a skill whose purpose is to run vet immediately after logical code changes, but this file implements a standalone exporter that parses Claude Code session history and emits transformed conversation/tool-use records. Exporting chat sessions is a materially different capability from triggering or performing vet, so the code's actual behavior diverges from the declared skill behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script exports full Codex session history, including user messages, assistant messages, tool invocations, and tool outputs, which is materially different from the skill's stated purpose of proactively running vet after code changes. This mismatch increases the risk of covert data collection and exfiltration of sensitive prompts, code, secrets, or tool output under the guise of a benign developer workflow skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill instructs the agent to use shell commands and read local files/session data, but it declares no explicit tool scope or permissions boundary. In a skill system, missing scope makes it easier for the skill to be invoked with broader-than-expected capabilities and obscures review of what sensitive resources it needs to access.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The instruction to run vet immediately after any logical unit of code changes and to be proactive is extremely broad, which can trigger repeated, automatic invocation without clear user intent. In context, because vet may read diffs and conversation history via shell and local files, overbroad activation increases the chance of unnecessary data exposure, noisy autonomous actions, and accidental use in sensitive contexts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script emits raw user messages, assistant messages, tool inputs, and tool results directly to stdout, which can include secrets, source code, file paths, or command output from the session file. In the context of a 'vet' skill, exporting full session history increases exposure because the data may be piped into logs, other tools, or remote analysis without any minimization or explicit acknowledgment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code reconstructs and emits structured session transcripts from a JSONL session file, including tool calls and outputs, despite the metadata claiming the skill exists only to run vet after logical code changes. In this skill context, unrelated transcript-export capability is suspicious because it can expose sensitive development context without a clear operational need.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes exported session history to a temporary file on disk before parsing it, which can expose sensitive chat content and tool output to local disclosure risks such as other privileged processes, backups, forensic recovery, or incomplete cleanup after abnormal termination. Because the file contains full session export data, the confidentiality impact can be broader than the narrow purpose of the skill suggests.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
    with os.fdopen(fd, "w+b") as f:
        try:
            result = subprocess.run(
                ["opencode", "export", args.session_id],
                stdout=f,
                stderr=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script exports full OpenCode session history even though the skill's stated purpose is only to run vet after code changes. That creates an unnecessary capability to access and transform potentially sensitive conversation and tool-use data, expanding the skill's access beyond its declared need and increasing the risk of privacy leakage or misuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends a session identifier to an external CLI to export conversation history without any evident user-facing disclosure that session data is being accessed and emitted. In the context of a skill advertised as merely running vet, this hidden data access is more concerning because users would not reasonably expect broad session-history processing.

Static analysis

No suspicious patterns detected.