ClawHub
Back to skill

Security audit

Vibes-Coded Agent Connector

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent marketplace connector, but it deserves review because it combines commerce/account actions with unpinned external installs and limited explicit consent boundaries.

Install only if you trust the publisher and are comfortable granting a marketplace connector access to scoped API/prepaid keys. Pin and review the npm package where possible, avoid mutable remote skill installs for sensitive use, and require explicit human approval for wallet signing, purchases, account linking, listing changes, job posting, resale actions, and credential storage.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned npm Dependency Permits Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

markdown
- Install: `npm install vibes-coded-agent-connector` (**>=0.1.6** includes `getReclaimPublicSummary()` for public reclaim totals).

Technical Analysis

The documented installation command does not specify an exact package version, integrity hash, or immutable lockfile. Consequently, npm resolves the package version available through the configured registry at installation time. The installed code can therefore differ from the version reviewed alongside this Skill.

This is particularly sensitive because the connector is intended to process API keys, wallet-signing workflows, purchases, marketplace listings, and uploaded content. The project does not include the connector implementation, so the installed package's runtime behavior cannot be verified from the audited artifact. This finding does not establish that the current npm package is malicious; it identifies an avoidable supply-chain trust boundary.

Attack Path

  1. An attacker compromises the npm publisher account, registry release process, or another relevant distribution component.
  2. The attacker publishes a modified release under the expected package name.
  3. An operator follows the documented unpinned npm install command.
  4. npm resolves and installs the compromised release rather than the previously reviewed implementation.
  5. When the connector is loaded or invoked, the substituted package executes with the privileges available to the agent runtime.
  6. The malicious package can attempt to read accessible runtime secrets, alter marketplace operations, tamper with uploads, or manipulate authenticated requests.

Impact Assessment

Successful exploitation could provide arbitrary code execution within the permissions of the npm installation or agent runtime. Potential ...[truncated 436 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the connector to an exact reviewed version, for example npm install vibes-coded-agent-connector@0.1.10.
  • Commit an npm lockfile containing integrity metadata and require reproducible, lockfile-enforced installation such as npm ci.
  • Verify package provenance, signatures, and registry integrity before installation.
  • Adopt automated dependency review and alerting for ownership changes, unexpected release artifacts, and compromised versions.
  • Run the connector in a restricted environment with minimal filesystem, environment-variable, wallet, and network access.
  • Expose only the credentials required for the current operation and rotate credentials after any suspected dependency compromise.
  • Consider vendoring or otherwise retaining the reviewed source and build artifacts when stronger reproducibility is required.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:133
Finding

Mutable Remote Hermes Skill Installation Lacks Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 133-134
Vulnerability Type: Mutable remote Skill dependency
Risk Level: Medium

Complete Code Snippet:

markdown
- Search: `hermes skills search https://doteyeso-ops.github.io/vibes-coded-agent-connector --source well-known`
- Install: `hermes skills install well-known:https://doteyeso-ops.github.io/vibes-coded-agent-connector/.well-known/skills/vibes-coded-agent-connector`

Technical Analysis

The documented workflow discovers and installs Skill content directly from a mutable GitHub Pages endpoint. It does not identify an immutable commit, release artifact, checksum, or cryptographic signature. Content served from that location can therefore change after this audit without any corresponding modification to the local project.

If the remote hosting account, deployment workflow, repository, or served content is compromised, later users may install instructions or components that differ from those reviewed. Because the remotely installed artifact is absent from this project, its effective behavior cannot be validated by this audit. This finding does not assert that the current hosted content is malicious.

Attack Path

  1. An attacker compromises the GitHub account, repository, Pages deployment pipeline, DNS path, or another component controlling the referenced endpoint.
  2. The attacker replaces the hosted well-known Skill with modified content.
  3. An operator runs the documented Hermes search and installation commands.
  4. Hermes retrieves the attacker-controlled current version because no immutable revision or expected digest is enforced.
  5. The agent loads or acts upon the substituted Skill content.
  6. The altered content may direct unauthorized network requests, solicit secrets, manipulate marketplace actions, or cause additional unsafe components to be retrieved.

Impact Assessment

The immediate scope includes the behavior of age ...[truncated 506 chars]

Remediation
View remediation

Remediation Suggestions

  • Publish immutable, versioned Hermes Skill artifacts rather than installing from a mutable well-known endpoint.
  • Pin installation to a reviewed release or commit identifier where the tooling supports it.
  • Publish a SHA-256 digest or cryptographic signature through an independent trusted channel and verify it before installation.
  • Require review whenever the remote artifact digest changes.
  • Protect the hosting repository and deployment workflow with phishing-resistant multifactor authentication, branch protection, restricted release permissions, and signed commits or releases.
  • Run remotely obtained Skills with least-privilege tool access, explicit network allowlists, isolated secrets, and human approval for purchases, uploads, wallet operations, and credential use.
  • Retain an auditable copy of the exact installed artifact so incident response can determine which content was executed.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
- `VIBES_CODED_BASE_URL` is optional and defaults to `https://vibes-coded.com`.
- `VIBES_CODED_PREPAID_KEY` (or store as `X-Vibes-Key`) — preferred for Outcome API loops; no per-call wallet.
- First-time registration should use wallet-native signing through a browser wallet, wallet adapter, hardware-backed signer, or another compatible signer already controlled by the operator.
- Do not ask the user to paste, transmit, or reveal raw private keys, seed phrases, recovery phrases, or exported keypairs in chat.

## Recommended flow

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
## Safety rules

- Never ask the user for a seed phrase.
- Never ask the user to paste a private key in plain text.
- Never ask the user to export or paste a raw keypair or secret key file.
- Use wallet-native signing only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
## Safety rules

- Never ask the user for a seed phrase.
- Never ask the user to paste a private key in plain text.
- Never ask the user to export or paste a raw keypair or secret key file.
- Use wallet-native signing only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
## Safety rules

- Never ask the user for a seed phrase.
- Never ask the user to paste a private key in plain text.
- Never ask the user to export or paste a raw keypair or secret key file.
- Use wallet-native signing only.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description and default prompt authorize broad external actions such as registering agents, storing API keys in runtime secrets, and initiating paid purchase flows, but they do not define explicit user-consent gates, trigger conditions, or scope limits. In a connector that can create accounts, link identities, and perform checkout-related actions, this ambiguity can let an agent overreach and take sensitive network and financial actions without sufficiently explicit user approval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.