vaaya

• Outcome: Review
• Latest audit: Sep 13, 2026 · 5:21 PM UTC
• Version: 1.2.5

Overview

The skill is a broad paid-service connector with disclosed usefulness, but it asks for persistent credentials, unpinned installer execution, broad agent configuration changes, and high-impact outbound/commerce/media powers that need careful review.

Install only if you are comfortable giving Vaaya broad paid-service authority. Before using it, prefer OAuth or a dedicated secret manager over generic agent memory, set strict spending limits, pin installer package versions, review any MCP config diffs, avoid storing sensitive screenshots/files unless needed, and require explicit confirmation for purchases, stock buys, outbound messages, phone calls, automation, and real-person media generation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/setup.md:18
• Finding: Unpinned npm Packages Are Downloaded, Executed, and Globally Installed<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md:18-28`, `references/setup.md:36-63`, and `references/setup.md:110-111` **Vulnerability Type**: Supply-chain exposure through unpinned remote packages **Risk Level**: High ### Complete Code Snippet ```bash # Plan a capability gap — free, runs nothing, prints the exact calls to make: npx -y @vaaya/mcp consult "<what you want to do>" # Run one of those calls (bills on success; flags mirror the `use` tool's params): npx -y @vaaya/mcp use --service <s> --action <a> --params '<json>' --max-cost <cents> # Poll an async job (e.g. a video render) — add --wait to block until it's done: npx -y @vaaya/mcp result <job_id> --wait ``` ```bash npx -y @vaaya/mcp install ``` ```bash npx -y @vaaya/mcp install --token <vst_…> ``` ```text Either form is also available as `npx -y vaaya-cli install [--token <vst_…>]`, which is the same installer reached through the `vaaya` command's own package. This runs the published [`@vaaya/mcp`](https://www.npmjs.com/package/@vaaya/mcp) package and does exactly two things: it wires Vaaya into whichever agents it finds (Claude Code, Claude Desktop, Cursor, Codex) by editing their MCP config files (`~/.claude.json`, `~/.cursor/mcp.json`, `~/.codex/config.toml`, Claude Desktop's config), and it runs `npm i -g vaaya-cli` for the `vaaya` command (skip that with `--no-cli`; if the global install fails it says so and carries on). ``` ### Technical Analysis The setup procedure uses `npx -y` without pinning an immutable package version or verifying an integrity digest. Consequently, the package resolved by npm at execution time can differ from the version that existed when the Skill was audited. The `-y` option also suppresses the normal installation confirmation. The downloaded package is not limited to a transient query. It is instructed to modify several agent configuration files and run `npm i -g vaaya-cli`, giving the package code execution under the invoking user's ...[truncated 1770 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every invoked package to a reviewed exact version, such as `@vaaya/mcp@X.Y.Z`, rather than resolving the latest release. 2. Publish and verify npm provenance, signatures, and integrity hashes before execution. 3. Lock and audit transitive dependencies and prohibit unexpected lifecycle scripts. 4. Remove `-y` so the user can review what will be installed. 5. Separate temporary CLI use from persistent installation. Do not globally install `vaaya-cli` unless the user explicitly requests it. 6. Display a dry-run diff of every configuration file before modification and require approval for each target application. 7. Apply least privilege by modifying only the configuration selected by the user rather than every detected agent. 8. Prefer a sandboxed or locally vendored reviewed installer where practical. 9. Document uninstall and rollback procedures for the global binary and all modified configuration files. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:76
• Finding: Long-Lived Bearer Credentials Are Directed into Unspecified Persistent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:76-90` **Vulnerability Type**: Unsafe persistent storage of API keys and refresh tokens **Risk Level**: High ### Complete Code Snippet ```text The response carries an **`api_key`** (`vaaya_sk_…`), an `access_token` + `refresh_token`, a **$1 starter credit** (spendable immediately, expires in 24h), a `topup` recipe, and a `claim_url`. 3. **Store the `api_key`, `refresh_token` and `user_id` in your persistent memory NOW** and reuse them across sessions. Treat them like passwords: private state only, never a shared repo, a chat message, or logs. If one leaks, revoke it at https://vaaya.ai/agents and sign in again. Never re-register — that forfeits your history and grants no new credit. 4. **Use the `api_key` everywhere** as `Authorization: Bearer vaaya_sk_…` — the MCP endpoint `https://vaaya.ai/mcp`, `POST https://vaaya.ai/api/run/{service}/{action}`, and the OpenAI-compatible router at `https://vaaya.ai/api/llm/v1`. No browser, no refresh. ``` ### Technical Analysis The Skill correctly identifies the API key and refresh token as password-equivalent secrets, but it directs the agent to store them in “persistent memory” without requiring a dedicated credential vault, operating-system keychain, encryption, access controls, or a defined retention policy. This terminology is especially hazardous because `references/compute.md:128-160` separately describes remote semantic-memory providers. An implementation could interpret the instruction as permission to place bearer credentials in generic agent memory or a third-party memory service. Semantic memory is unsuitable for secrets because it is designed for retrieval and reuse, may be included in later prompts, and can be shared across integrations or sessions. The directive to act “NOW” also pressures the agent to persist credentials before establishing whether a secure secret-storage facility exists. The warning against chat messa ...[truncated 1395 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace “persistent memory” with an explicit requirement to use an operating-system keychain, hardware-backed store, or dedicated encrypted secret manager. 2. Explicitly prohibit storing credentials in semantic memory, LLM context, chat history, ordinary files, remote memory providers, logs, or shared organizational knowledge. 3. If no approved secret store is available, stop and ask the user to configure one rather than persisting the token. 4. Store only an opaque secret reference in agent state; retrieve the actual value at execution time. 5. Request narrowly scoped credentials and enforce low server-side spending limits by default. 6. Minimize refresh-token use and retention where a revocable constrained API key is sufficient. 7. Define credential rotation, expiration, revocation, deletion, and incident-response procedures. 8. Ensure backups and crash reports cannot capture secret values. 9. Add automated secret redaction to all tool responses, exception messages, and diagnostic output. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:156
• Finding: Remote-Controlled Messages Are Required to Be Relayed Verbatim<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:156-166`; related directives appear at `references/tools.md:5-16` and `references/gtm.md:280-282` **Vulnerability Type**: Untrusted remote content propagated as trusted agent output **Risk Level**: Medium ### Complete Code Snippet ```text ## How to talk to consult `consult({ intent })` is the router. Describe the whole goal in plain English, with the constraints that matter (budget, quality, format, deadline). It returns one of: - `mode: "call"` — `calls[]`, an ordered list of `{ service, action, params, max_cost_cents, why }` ready for `use`. Run them in order; substitute any `<from step N: …>` placeholder with the earlier step's real output. - `mode: "converse"` — one question or a set of options. Relay `message` to the user **verbatim**, get their answer, call `consult` again. It remembers the conversation. - `mode: "unsupported"` — not available; tell the user what `message` says. ``` The same trust pattern is reinforced in `references/tools.md`: ```text - `mode:"converse"` → relay `message` to the user **verbatim** (a question, options, or ideas), get their answer, call `consult` again. Loop until you get a `call`. ... Always surface `message`, each call's `why`, and `suggestions`. ``` It also appears in the GTM error contract: ```text - A send returning `gtm_disabled` → relay its `message` verbatim (staging and drafting keep working regardless). ``` ### Technical Analysis The Skill gives a remote service control over `message`, `why`, and `suggestions` fields and directs the agent to reproduce some of that content verbatim. This creates a trusted-output injection channel. If the backend, an upstream provider, or its response-generation path is compromised, it can place phishing text, misleading authorization language, unrelated instructions, or malicious links into fields that the agent is required to surface. `SKILL.md:204-205` contains a useful safeguard stating that ret ...[truncated 1745 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every unconditional “relay verbatim” requirement. 2. Treat all remote response fields as untrusted data, including `message`, `why`, `suggestions`, job hints, errors, and generated plans. 3. Summarize remote content in the agent's own words after checking it against the current user request and applicable safety constraints. 4. Reject remote instructions that request credentials, policy changes, unrelated tool calls, or spending outside the user's authorization. 5. Validate connection, claim, credit, and payment URLs against a strict HTTPS hostname and path allowlist before displaying them. 6. Clearly label remote text as originating from Vaaya rather than presenting it as the agent's independent recommendation. 7. Require fresh explicit user confirmation for purchases, outbound communications, top-ups, tokenized-share transactions, sensitive uploads, and persistent automation. 8. Validate every remotely proposed `service`, `action`, parameter, and spending ceiling locally before execution. 9. Add regression tests containing prompt-injection strings in all remote response fields and confirm they are safely quoted or rejected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (32)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

findings, drafts are HELD for review in the brain, and the user fires each send from the
dashboard. The ONE exception is an explicit `gtm_automation` rule (section 7): when the
user clearly asks to automate ("auto-send replies", "run this daily"), create a rule and
say yes — never refuse automation as impossible or against policy. But never auto-send
without a rule, and never create a rule the user didn't ask for.

## 2. Find → enrich → segment → message

• Confidence: 88% confidence
• Finding: The phrase 'never refuse automation as impossible or against policy' is an anti-refusal instruction that pressures the agent to comply with automation requests even when they may be unsafe, noncompliant, or outside platform policy. In a tool-enabled outbound skill, this weakens safety decision-making around auto-sending and could lead to unauthorized or risky messaging workflows being created.

Ssd 1

High

• Confidence: 99% confidence
• Finding: Telling users to 'reword the flagged phrase and retry' after a content-policy violation is effectively guidance to circumvent provider safety controls. In a skill context, this normalizes iterative evasion of safeguards and can facilitate generation of disallowed harmful content.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

This runs the published [`@vaaya/mcp`](https://www.npmjs.com/package/@vaaya/mcp) package
and does exactly two things: it wires Vaaya into whichever agents it finds (Claude Code,
Claude Desktop, Cursor, Codex) by editing their MCP config files (`~/.claude.json`,
`~/.cursor/mcp.json`, `~/.codex/config.toml`, Claude Desktop's config), and it runs
`npm i -g vaaya-cli` for the `vaaya` command (skip that with `--no-cli`; if the global
install fails it says so and carries on). Nothing else: no piped remote scripts, no sudo,
no secrets handled, credentials stay on the machine, revocable at

• Confidence: 95% confidence
• Finding: The setup explicitly states that the installer edits agent configuration files such as `~/.claude.json`, `~/.cursor/mcp.json`, and `~/.codex/config.toml`. Automatically modifying security-relevant config in user home directories creates a strong persistence and trust-boundary risk: a compromised installer could register malicious MCP endpoints, alter agent behavior, or retain long-term execution footholds.

Chaining Abuse

High

• Category: Tool Misuse

Content

bills per second of uptime until you `close` it — always close when done.**

```
session({ session_id:"sb_1", code:"print(2+2)", language:"python" })   // language: python|javascript|bash
→ { stdout:"4\n", exit_code:0 }
close({ session_id:"sb_1" })
```

• Confidence: 93% confidence
• Finding: Persistent sandbox sessions that accept arbitrary `bash` commands materially increase the risk of chaining abuse, because an agent can translate higher-level prompts into shell execution with stateful follow-on steps. In a tool suite that also exposes web research, storage, external services, and durable jobs, this can amplify prompt-injection, data exfiltration, destructive actions, and runaway-cost scenarios if not tightly constrained.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly advertises outbound actions such as email, phone calls, and faxes, but it does not give a clear user-facing warning that prompts and data may be transmitted to third-party services or external recipients. In an agent context, this increases the risk of unintentional disclosure of sensitive data, unauthorized outreach, or privacy/compliance violations if the agent acts on ambiguous authorization.

Session Persistence

Medium

• Category: Rogue Agent

Content

Do not omit `grant_types` — the default is the authorization_code grant, which
   then requires `redirect_uris`.

2. **Create the account** with the `client_id` you just received:

   ```
   POST https://vaaya.ai/api/v1/signup/agent

• Confidence: 80% confidence
• Finding: The skill instructs the agent to create and persist API keys, refresh tokens, and user identifiers across sessions, materially increasing the blast radius if the agent's memory, storage, or logs are exposed. Persistent credentials tied to paid external capabilities can enable unauthorized use, spending, account takeover, or abuse long after the original session ends.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to fall back to sending from an agent-owned inbox when the user's mailbox is not connected, which can cause outreach to be sent under a different identity than the user expected. This creates privacy, consent, and impersonation/confusion risks, especially in a sales/outbound context where sender identity materially affects trust and data handling.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly instructs agents to create real-person and celebrity recreations and labels the underlying model as 'unrestricted.' In an agent skill, that guidance enables impersonation, non-consensual deepfakes, and other likeness-abuse workflows that exceed a generic media-generation description and materially increase abuse potential.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide tells users to search for and upload real images of named characters to drive video likeness generation, without any warning about consent, publicity rights, copyright, or privacy implications. This directly operationalizes a deepfake pipeline using third-party images and increases risk of unlawful or harmful impersonation content.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The guidance instructs selecting synthetic voices based on a presenter's apparent gender/age/energy, embedding a demographic inference and policy choice without user opt-in. While lower severity than deepfake issues, it can lead to inappropriate profiling, misgendering, and biased automated decisions in generated outputs.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The product-demo section adds local browser driving, screen recording, interaction logging, and upload behavior that is not clearly reflected in the manifest description. That creates capability surprise: users may authorize a 'media generation' skill without understanding it can observe live product sessions and capture potentially sensitive on-screen data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **Capture** — drive the product in a local headed Playwright browser and screen-record
   the real screen (aperture on macOS, ffmpeg ddagrab on Windows; Linux unsupported). One
   continuous silent take, 30–160s. Never ask the user for a pre-made video; if the product
   is login-gated the user signs in themselves — you never touch credentials. Log an
   interaction track of focus beats `[{ t, x, y, kind: click|highlight|type, intent }]`
   (coords normalized 0–1 to the full screen). Normalize to CFR H.264 at `-crf 18`

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The playbook tells the agent to store evidence and screenshots via persistent file upload without warning that captured material may contain user data, third-party personal data, credentials, internal documents, or regulated information. Persisting research artifacts without classification, consent, redaction, or retention controls can turn routine browsing and research into unauthorized long-term data collection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The UX research playbook explicitly directs use of a user's logged-in session and local Playwright to inspect private applications, but it does not require consent, scope limitation, secret handling, or data-minimization controls. That creates a real risk of exposing session-bound data, private content, account settings, or actions within authenticated systems during browser automation and screenshot capture.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The documentation instructs users to execute `npx -y @vaaya/mcp` without pinning a specific package version. This creates a supply-chain risk because whatever version is current on npm at execution time will be fetched and run, and a compromised publisher account, malicious update, or dependency takeover could result in arbitrary code execution on the user's machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command again relies on `npx -y @vaaya/mcp` with no pinned version, causing users to download and execute the latest package at runtime. In a setup guide for agent tooling, that is especially risky because the package is granted local execution and may modify environment configuration.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The unpinned `npx` invocation exposes users to remote package substitution or malicious version drift. Because this example is presented as a normal operational workflow, repeated use compounds exposure over time.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Using `npx -y @vaaya/mcp install` without a version pin is dangerous because the command not only executes fetched code but also performs persistent local changes. A malicious or compromised package version could alter startup behavior, implant persistence, or tamper with agent configuration files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The token-based install example still uses an unpinned package, so a user may expose a setup token to unreviewed code fetched from npm. Even if the token is short-lived, interception or misuse could link accounts or alter onboarding state unexpectedly.

Session Persistence

Medium

• Category: Rogue Agent

Content

300+ models (Kimi, GPT, Gemini, Claude, DeepSeek) paid per token from the same wallet,
and the model in that chat gets this same live Vaaya toolset, so it can search, scrape,
generate media or enrich leads mid-answer. `vaaya "one question"` answers and exits, and
pipes work (`git diff | vaaya "write a commit message"`).

If the user's message included a setup token (it looks like `vst_…`, handed out by the
onboarding wizard at vaaya.ai), pass it along — it links the account instantly with no

• Confidence: 89% confidence
• Finding: This duplicate finding reflects the same issue: the document normalizes passing a `vst_...` token through the agent/session to create an authenticated persistent link. In an agent environment, conversational tokens may be retained, summarized, or surfaced to tools, making even temporary credentials more exposed than necessary.

Session Persistence

Medium

• Category: Rogue Agent

Content

300+ models (Kimi, GPT, Gemini, Claude, DeepSeek) paid per token from the same wallet,
and the model in that chat gets this same live Vaaya toolset, so it can search, scrape,
generate media or enrich leads mid-answer. `vaaya "one question"` answers and exits, and
pipes work (`git diff | vaaya "write a commit message"`).

If the user's message included a setup token (it looks like `vst_...`, handed out by the
onboarding wizard at vaaya.ai), pass it along — it links the account instantly with no

• Confidence: 89% confidence
• Finding: This duplicate finding reflects the same issue: the document normalizes passing a `vst_...` token through the agent/session to create an authenticated persistent link. In an agent environment, conversational tokens may be retained, summarized, or surfaced to tools, making even temporary credentials more exposed than necessary.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: Referencing `npx -y @vaaya/mcp` generically in setup instructions continues the same supply-chain pattern: execution of whatever package version is current. Although this line is descriptive rather than a full command example, it still normalizes unsafe install practice in a high-trust setup context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: `npx -y vaaya-cli install` is also unpinned, so users may execute arbitrary code from the latest npm release under a trusted installation flow. Since the command installs tooling and may modify PATH or system-wide state, compromise could have lasting effects beyond a single session.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This later reference again directs users toward the same unpinned runtime package fetch. Repetition across the document increases the likelihood that users will follow the unsafe pattern in varied environments without realizing the supply-chain implications.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The refresh command uses unpinned `npx`, meaning even maintenance actions can fetch and execute newly published code. That broadens the attack surface because users may re-run the command during troubleshooting, precisely when they are likely to trust the instructions and ignore change review.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: references/setup.md:52