Deepvista Vistabase

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 0.1.0-alpha.21

Overview

This skill coherently provides read-only commands to view and search DeepVista memory context, with a noted supply-chain caution around its unpinned CLI dependency.

Install this only if you trust the DeepVista CLI package and the related deepvista-shared skill, since the commands can reveal private memory context from Chat. Prefer a pinned, reviewed CLI release where available, and avoid running the tool in environments with unrelated sensitive files or credentials exposed unnecessarily.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-13
Vulnerability Type: Unpinned third-party package dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml

requires:
  bins:
    - deepvista
  skills:
    - deepvista-shared
install:
  - kind: uv
    package: deepvista-cli
    bins: [deepvista]

Technical Analysis

The skill installs deepvista-cli through uv without specifying an exact version or an integrity hash. Consequently, the package version and implementation installed can change after this skill has been reviewed. The dependency's source code is not included in the audited project, so its installation behavior, runtime behavior, and handling of authentication or memory data could not be verified.

This creates a supply-chain risk: compromise of the package registry, package owner account, or a future package release could cause malicious code to be installed under the trusted deepvista-cli name. The referenced deepvista-shared sibling skill is also absent from the provided project, preventing verification of its authentication and data-handling instructions.

Attack Path

1. An attacker compromises the package publisher, distribution channel, or a future release of deepvista-cli.
2. The attacker publishes a malicious version under the expected package name.
3. The skill installation process resolves the unpinned dependency to that malicious version.
4. The package is installed and exposes the expected deepvista executable.
5. When the user or agent invokes a documented command such as deepvista vistabase show, attacker-controlled code executes with the invoking user's privileges.

Impact Assessment

A malicious dependency could execute arbitrary code with the privileges of the account installing or running the CLI. Depending on the runtime environment, this may permit access to local files, environment variables, authentication material, ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

• Pin deepvista-cli to a specific, reviewed version rather than allowing unconstrained resolution.
• Enforce package integrity verification using an approved lockfile and cryptographic hashes.
• Document and restrict the package index or registry from which the dependency may be retrieved.
• Review the source and packaged artifacts of the pinned release before deployment.
• Apply automated dependency monitoring while requiring explicit review before version updates.
• Include or separately audit the required deepvista-shared skill, particularly its authentication, credential storage, and data-transmission behavior.
• Run the CLI with least privilege and restrict its access to sensitive files, credentials, and unnecessary network destinations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.