Vibe-Switch

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent multi-agent orchestration guide, but it asks users to globally install and run an unpinned external CLI with broad local process and repository control.

Review the npm package/source before installing, prefer an exact version such as `vibe-switch@1.0.2` if that is the version you intend to trust, and understand that spawned non-sandboxed agents may read or change repository files and may use their own network/auth configuration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Global npm Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 16–18 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```yaml install: method: npm command: "npm install -g vibe-switch" registry: https://www.npmjs.com/package/vibe-switch ``` The same command is repeated at lines 55–57: ```bash npm install -g vibe-switch ``` ### Technical Analysis The documented installation procedure resolves the current npm release of `vibe-switch` rather than an exact, reviewed version. It also provides no lockfile, package integrity hash, or reproducible provenance data. Because npm packages may contain lifecycle scripts, installation can execute package-controlled code with the privileges of the user running npm. The `-g` option expands the effect beyond this project by installing an executable into the user's global npm environment. The audited artifact contains only `SKILL.md`; it does not include the package implementation. Therefore, claims that the installed program makes no runtime network requests, does not access credentials, and performs only the documented operations cannot be independently verified from this artifact. This finding establishes an unsafe supply-chain installation pattern. It does not establish that the current npm package is malicious. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a future release process. 2. The attacker publishes a modified `vibe-switch` release containing a malicious lifecycle script or executable. 3. A user follows the Skill documentation and runs `npm install -g vibe-switch`. 4. npm resolves the attacker-controlled current release because no exact version is specified. 5. Package lifecycle code may execute during installation with the installing user's privileges. 6. The globally installed `vibe` executable may subsequently execute attacker logic when the us ...[truncated 708 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact audited version, such as `vibe-switch@1.0.2`, rather than resolving the latest release. - Prefer a project-local, lockfile-backed installation over `npm install -g`, reducing the package's scope and making dependency resolution reproducible. - Publish and verify package integrity and provenance information, including npm provenance attestations and release checksums where applicable. - Review the package contents and lifecycle scripts before installation, for example with `npm pack` and package metadata inspection. - Use `--ignore-scripts` when the package is confirmed to function without lifecycle scripts. - Include the executable source or a verifiable source-to-package build process so the documented runtime and credential-access claims can be independently audited. - Document a trusted release-validation and publisher-account protection process, including mandatory multifactor authentication.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

runtime: false — vibe-switch itself makes no network requests at runtime
  spawned_agents: varies — Claude and Gemini CLIs may access the network; Codex CLI runs in a sandbox with no network access
permissions:
  - filesystem: read/write to ~/.vibe-switch/ for task state, logs, and snapshots
  - filesystem: create/remove Git worktrees in sibling directories of the repository
  - process: spawns agent CLI subprocesses (claude, codex, gemini) and manages their PIDs
  - network: vibe-switch makes zero network requests at runtime; network behavior of spawned agents is controlled by each agent's own configuration

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.