Security audit

vibe-coding-toolkit

Security checks across malware telemetry and agentic risk

Overview

This is a local project-governance toolkit, but it needs Review because it can persistently alter project and agent state and has broad snapshot routing plus an under-scoped review check.

Install only if you are comfortable with a local governance skill that can create .vibe-coding files, install a commit-msg hook, append a WorkBuddy memory pointer, and manage local snapshots. Before use, consider disabling HOOK_ENABLED if you do not want Git hook enforcement, review any .workbuddy/memory/MEMORY.md change, and require explicit confirmation before snapshot rollback or cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill makes strong safety claims such as zero environment-variable reading and writes only within the current project directory, yet the documented/observed behavior includes environment-derived values and writes into .git/hooks/commit-msg. This mismatch is dangerous because operators may grant the skill more trust than warranted, and hook installation changes repository behavior persistently in a way users may not expect from a supposedly local read-only governance tool.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script appends content into .workbuddy/memory/MEMORY.md, which is the host agent's memory area rather than the toolkit's own governance directory. This breaks the stated isolation boundary and can tamper with host-agent state or create unintended cross-tool influence, especially because it writes automatically during initialization.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The review handler accepts a specific task_id but verifies completion status and extracts commit metadata from the entire TASKS file, not from the requested task block. This can let an attacker or careless user obtain a false 'review passed' result for one task by relying on another completed task's commit, undermining audit integrity and allowing incorrect approval records.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases for project-init are broad and include common requests like 'new project', 'backup', or 'remember the current state', which could cause the agent to route into an initialization or snapshot-writing path unintentionally. In the context of a shell-executing skill that can modify governance files and install Git hooks, accidental invocation can lead to unexpected filesystem changes or persistent repository-side effects.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The snapshot trigger set includes broad, everyday phrases such as '备份一下', '记一下现在的状态', and '撤销刚才的修改', which can plausibly appear in normal conversation without the user intending to invoke a state-changing command. Because snapshot operations can create backups, restore prior versions, or delete old snapshots, accidental routing could lead to unintended file system changes inside the project directory.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.