ClawHub
Back to skill

Security audit

v0-cli

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent v0.dev CLI helper, but users should know generated projects may be public unless they choose private visibility.

Install only if you want an agent to operate your v0.dev account. Prefer `--privacy private` for non-public work, review the external npm CLI before giving it `V0_API_KEY`, and do not include secrets, private code, customer data, or confidential business details in prompts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation shows that `v0 create` defaults to `public`, but it does not prominently warn agents or users that generated website content may be published publicly unless `--privacy private` or another safer option is explicitly set. In an automation-oriented skill, this increases the chance that sensitive prompts, internal project details, mock credentials, or proprietary UI concepts are unintentionally exposed through a public chat/project.

Static analysis

No suspicious patterns detected.