Security audit

Vibe UI

Security checks for vulnerabilities and agentic risk

Overview

This is a local UI-design helper with some broad reference data and an explicit URL-fetch command, but I found no hidden credential access, persistence, exfiltration, or malicious behavior.

Install this as a local design workflow skill, not as a connector or media-generation tool. Expect it to write design files and .vibe-ui metadata in the project where commands are run. Use extract-url only with public or trusted URLs, especially in corporate environments, and do not treat mirrored upstream template descriptions as permission to access Gmail, Notion, finance, medical, or other sensitive data.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The index materially exceeds the stated scope of a UI-style skill by bundling templates for social research, connector-backed digests, financial/medical analysis, and media generation. This creates a scope-expansion and unintended-capability risk: an agent may invoke workflows that access external data, produce non-UI outputs, or handle sensitive domains under the guise of a design skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Advertising authenticated connector digests and live-data artifacts inside a UI-style skill increases the chance that an agent routes requests into workflows touching external accounts or live data without users expecting that behavior from this skill. Even if the JSON is only an index, exposing these capabilities broadens the reachable attack surface and weakens least-privilege boundaries.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Including audio, image, and video generation templates in a UI-style skill is a capability mismatch that can cause overbroad activation and unexpected non-UI behavior. This is dangerous because users and orchestrators may trust the skill as design-only, while it can steer tasks into media-generation workflows with different cost, safety, and policy implications.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: Overly broad trigger terms increase the probability of unintended skill activation, causing this skill to intercept generic user requests and potentially route them into unrelated templates. In the context of an over-scoped index, this becomes more dangerous because accidental activation can unlock non-UI capabilities that the user did not request.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger "email" is so generic that it is likely to match ordinary requests about communication, debugging email issues, or drafting messages, causing unintended invocation of the email-marketing template. Because this skill already contains out-of-scope templates, such collisions increase the chance of misrouting users into irrelevant or higher-risk workflows.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Generic triggers like "deck", "slides", "ppt", and "presentation" are highly collision-prone and can cause the skill to activate for a wide range of unrelated requests. In a large multi-capability index, this can steer users away from the intended tool or silently broaden what the agent attempts to do.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Triggers like "prototype", "mockup", and "landing" are overly ambiguous and likely to overmatch everyday product, design, and engineering requests. Since this template is described as a default fallback, these broad triggers can effectively hijack routing and increase the odds of accidental use of an unintended workflow.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The `loadUrlOrFile` path performs `fetch(input)` on arbitrary user-supplied URLs without any user-facing warning, confirmation, or disclosure that data will be sent outbound. In an agent or enterprise environment, this can cause unintended network access, including requests to internal services or sensitive endpoints, creating SSRF-like risk and privacy surprises.

Static analysis

No suspicious patterns detected.