vitepress-config-optimization

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only VitePress helper skill with some supply-chain and deployment hardening cautions, but no hidden execution, persistence, exfiltration, or purpose-mismatched behavior was found.

Reasonable to install as VitePress reference material. Before copying commands, pin package versions where practical, prefer local project scripts over unpinned npx, scope deployment tokens and GitHub Actions permissions narrowly, and use least-privilege CMS/API tokens for fetch examples.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/deploy.md:63

Finding

GitHub Pages deployment permissions are granted at workflow scope

Content

View full analysis

Vulnerability Details

File Location: references/deploy.md:63-66
Vulnerability Type: Excessive CI/CD token permissions
Risk Level: Medium

yaml

permissions:
  contents: read
  pages: write
  id-token: write

Technical Analysis

The workflow grants pages: write and id-token: write globally. Consequently, both the build and deployment jobs inherit permissions intended only for the deployment operation.

The build job executes npm ci and npm run docs:build. These operations can execute package lifecycle scripts, build plugins, and project-controlled JavaScript. If any such component is compromised, it can run while the job has access to the workflow's elevated GitHub token permissions and OIDC token request capability.

GitHub Pages deployment legitimately requires these permissions, but they should be assigned only to the deploy job. Granting them to the build job exceeds the minimum privileges necessary.

Attack Path

1. An attacker compromises a dependency, lifecycle script, build plugin, or project build script executed by the build job.
2. The malicious code runs during npm ci or npm run docs:build.
3. Because permissions are defined at workflow scope, the build job has pages: write and id-token: write.
4. The malicious process accesses the GitHub token or requests an OIDC identity token through the GitHub Actions OIDC endpoint.
5. The attacker attempts to modify GitHub Pages deployment state or authenticate to an external service configured to trust the repository's GitHub OIDC identity.

Impact Assessment

A successful exploit could affect the repository's GitHub Pages deployment and potentially allow publication of attacker-controlled site content. If an external cloud provider trusts this workflow identity without sufficiently restrictive claims, the OIDC token could also provide access to associated cloud deployment resources. The issue does not inherently grant ...[truncated 71 chars]

Remediation

View remediation

Remediation Suggestions

Apply least privilege at job scope:

yaml

permissions:
  contents: read

jobs:
  build:
    permissions:
      contents: read
    # Build steps...

  deploy:
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
    # Deployment steps...

Additionally:

• Protect the github-pages environment with deployment approval and branch restrictions where appropriate.
• Restrict cloud trust policies using repository, branch, workflow, and environment claims.
• Audit package lifecycle scripts and consider npm ci --ignore-scripts when lifecycle scripts are unnecessary.
• Ensure untrusted pull requests cannot execute a privileged deployment workflow.

T08 · Insecure Dependencies

Warning

• Location: references/deploy.md:75

Finding

Privileged deployment workflow uses mutable GitHub Action references

Content

View full analysis

Vulnerability Details

File Location: references/deploy.md:75-101
Vulnerability Type: Mutable third-party CI/CD dependencies
Risk Level: Medium

yaml

- name: Checkout
  uses: actions/checkout@v5
  with:
    fetch-depth: 0
- name: Setup Node
  uses: actions/setup-node@v6
  with:
    node-version: 24
    cache: npm
- name: Setup Pages
  uses: actions/configure-pages@v4
- name: Install
  run: npm ci
- name: Build
  run: npm run docs:build
- name: Upload artifact
  uses: actions/upload-pages-artifact@v3
  with:
    path: docs/.vitepress/dist
# ...
- name: Deploy
  uses: actions/deploy-pages@v4

Technical Analysis

GitHub Actions are referenced by major-version tags rather than immutable commit hashes. Tags can resolve to different code over time. Although these examples use official GitHub-maintained actions, mutable references weaken reproducibility and leave the workflow dependent on the continued integrity of each upstream repository and release tag.

This is especially relevant because the actions operate in a deployment pipeline. They can access checked-out source, build artifacts, workflow environment data, and job-level credentials. The deployment action also runs in a job authorized to publish to GitHub Pages.

Attack Path

1. An attacker compromises an upstream action repository, maintainer account, release process, or mutable version tag.
2. A referenced tag is changed or a malicious release is published under the expected major version.
3. The next workflow run downloads and executes the modified action automatically.
4. The malicious action reads accessible workflow data, modifies the build artifact, or abuses the permissions of its job.
5. In the deployment job, attacker-controlled action code publishes altered site content or abuses available deployment credentials.

Impact Assessment

Exploitation could compromise build integrity, expose acce ...[truncated 296 chars]

Remediation

View remediation

Remediation Suggestions

Pin every action to a reviewed full commit SHA while retaining a version comment for maintainability:

yaml

- uses: actions/checkout@<reviewed-full-commit-sha> # v5
- uses: actions/setup-node@<reviewed-full-commit-sha> # v6
- uses: actions/configure-pages@<reviewed-full-commit-sha> # v4
- uses: actions/upload-pages-artifact@<reviewed-full-commit-sha> # v3
- uses: actions/deploy-pages@<reviewed-full-commit-sha> # v4

Use Dependabot or Renovate to propose SHA updates through reviewed pull requests. Verify release provenance and changelogs before accepting updates. Combine immutable pinning with job-level permissions so that each action receives only the privileges required for its task.

T08 · Insecure Dependencies

Error

• Location: references/deploy.md:184

Finding

Unpinned package is downloaded and executed through npx during deployment

Content

View full analysis

Vulnerability Details

File Location: references/deploy.md:184
Vulnerability Type: Unpinned on-demand dependency execution
Risk Level: High

sh

npx surge docs/.vitepress/dist

Technical Analysis

The command does not specify an exact surge package version. If the package is not already installed locally, npx can retrieve a package from the configured npm registry and execute it immediately.

This bypasses the stronger reproducibility guarantees provided by an exact dependency version and a reviewed lockfile. Package CLI code and applicable lifecycle behavior run with the permissions and environment of the deployment process. That environment may contain deployment credentials required by Surge or other CI secrets.

Attack Path

1. An attacker compromises the surge npm package, its publisher account, the package release process, or the registry resolution path.
2. A user or CI job runs the documented npx surge command without a reviewed local version.
3. npx resolves and downloads the current package version from the registry.
4. Attacker-controlled package code executes in the deployment environment.
5. The code reads accessible environment variables, source files, generated site content, or deployment credentials and may transmit them externally.
6. The malicious CLI can also replace the intended deployment artifact or publish attacker-controlled content.

Impact Assessment

Successful exploitation permits arbitrary code execution under the account running the command. In CI, this may expose deployment tokens and other job-scoped secrets, compromise generated documentation, or allow unauthorized deployment. On a developer workstation, accessible project files and user-level credentials may also be affected.

Remediation

View remediation

Remediation Suggestions

Install an explicitly reviewed version as a development dependency and commit the lockfile:

sh

npm install --save-dev --save-exact surge@<reviewed-version>
npm exec --offline -- surge docs/.vitepress/dist

Further hardening should include:

• Use npm ci in CI to enforce the committed lockfile.
• Review package provenance, maintainers, release history, and integrity metadata.
• Configure registry allowlists or an internal package proxy where appropriate.
• Run deployment in an isolated job with only the specific deployment credential required.
• Rotate deployment credentials if an untrusted package version may have executed.
• Avoid exposing unrelated repository or cloud credentials to the deployment process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/routing.md (reported line 23)May include surrounding context.

Linking

md

<!-- Relative, recommended -->
[Getting Started](./getting-started)
[Guide](../guide/getting-started)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-loading-ssr-i18n.md (reported line 31)May include surrounding context.

javascript

export default {
  async load() {
    return await fetch('https://api.example.com/data').then(r => r.json())
  }
}

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation instructs users to run npx vitepress init without pinning a specific package version. npx may fetch the latest package from the registry at execution time, which creates a supply-chain risk: users could unknowingly execute newly published or compromised code. In a getting-started guide, this is more dangerous because it directly encourages copy-paste execution by new users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The example npx vitepress dev docs also invokes an unpinned package name through npx, which can download and execute whatever version is current in the registry if no local version is resolved. Although this is common documentation practice, it still exposes users to avoidable supply-chain execution risk, especially in setup instructions meant for direct reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file includes an example that fetches data from an external CMS API using token-bearing headers, which implies network transmission of potentially sensitive data. The surrounding documentation does not include any warning or disclosure about external data transfer, token handling, or privacy considerations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes an example that fetches content from an external CMS, which is a behavior that could affect privacy or transmit data, but the surrounding documentation does not include any warning or disclosure about external network access. Under the markdown-file criteria for SQP-2, examples that imply data transfer should be accompanied by some warning when relevant.

Content

No source excerpt is available for this finding.