Security audit
vindex
Security checks for vulnerabilities and agentic risk
Overview
The skill is a documentation-only API guide for vehicle data lookups and paid x402 calls, with no local code, persistence, or hidden execution behavior.
Before installing, review the paid endpoint prices and make sure your agent is configured to ask before making x402 payments. The main privacy consideration is sending VINs and purchase-cost parameters to the Vindex API; the artifact states VINs are cached remotely for up to 90 days and not linked to a person.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.