vibes

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

The skill’s social posting behavior is mostly coherent, but it launches a mutable third-party MCP package with local execution authority.

Review this skill before installing because it runs a third-party MCP package via `npx` using the mutable `latest` tag. Treat anything posted with `/vibes "message"` as shared outside your local project, and avoid secrets, proprietary code, credentials, personal data, or confidential internal details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–9
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"mcp":{"command":"npx","args":["vibes-mcp@latest"],"env":{"VIBES_API_URL":"https://vibes-api.fly.dev"}}}}

Technical Analysis

The skill configures npx to retrieve and execute vibes-mcp@latest. The latest tag is mutable and does not constrain execution to the package version reviewed during this audit. No lockfile, integrity hash, or other verification mechanism is present in the audited project.

Consequently, the effective code can change without any modification to SKILL.md. A compromised package release, package publisher account, or upstream distribution channel could cause arbitrary attacker-controlled package code to execute when the MCP server is launched.

This is classified as an insecure dependency because execution relies on an unpinned third-party package obtained through the package supply chain.

Attack Path

1. An attacker compromises the vibes-mcp package, its publisher account, or its release process.
2. The attacker publishes a malicious version and assigns it to the latest distribution tag.
3. The skill runtime invokes npx vibes-mcp@latest.
4. npx resolves and retrieves the attacker-controlled release.
5. The malicious package executes with the permissions and environment available to the agent process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the process launching the MCP server. Depending on the runtime's sandboxing and accessible resources, malicious package code could read or modify local files, inspect exposed environment variables, initiate network requests, tamper with MCP responses, or perform other actions available to that process.

The exact scope is constrained by the host's process permission ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

• Replace vibes-mcp@latest with an exact, reviewed package version.
• Maintain a lockfile that records the complete transitive dependency graph.
• Verify package integrity using registry integrity metadata, a trusted checksum, or a signed artifact before execution.
• Prevent automatic package upgrades in production and require security review before changing the pinned version.
• Prefer preinstalling the verified package rather than allowing npx to retrieve executable code at invocation time.
• Run the MCP server in a restricted environment with least-privilege filesystem access, a minimal environment, and network access limited to required destinations.
• Continuously monitor the dependency and its transitive dependencies for ownership changes, compromised releases, and known vulnerabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to send a user-provided message to an external MCP-backed service, but it does not clearly warn that the content will leave the local environment and be shared remotely. This creates a meaningful privacy risk because users may include sensitive project details, secrets, or internal context in what appears to be a lightweight social command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.