AIclude Security Scanner

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:28 PM UTC
• Version: 3.0.0

Overview

The skill is a disclosed vulnerability lookup tool that sends a package name and type to AICLUDE, with dependency hygiene issues that should be fixed but no artifact-backed malicious behavior.

Install only if you are comfortable sending queried package names and target types to AICLUDE for lookup and possible server-side scanning. The publisher should refresh the lockfile and patch the flagged dev dependencies, especially before running tests, build tools, or dev servers in shared or untrusted environments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: vitest 4.0.18 is a genuinely vulnerable version with advisories for arbitrary file read and, in some configurations, code execution through Vitest UI or mocking features. Even though it is a dev dependency, the skill context is security-oriented and may encourage running scans/tests in automated or semi-exposed environments, which increases the chance that unsafe test infrastructure could be reachable or process untrusted content.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: nanoid 3.3.11 is a real vulnerable version according to the listed advisories affecting generator behavior, including infinite-loop and overflow edge cases. In this dependency graph it is transitive and primarily impacts availability or correctness when unsafe generator APIs or attacker-influenced size values are used, so the package is vulnerable even if exploitability here is context-dependent.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: picomatch 4.0.3 is a genuine vulnerable version with reported glob parsing issues including ReDoS and method-injection style matching flaws. In this lockfile it is a transitive dependency of build/test tooling, so the main danger is denial of service or incorrect file matching when attacker-controlled glob patterns are processed.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: postcss 8.5.6 is a known vulnerable version with multiple advisories including arbitrary file read and XSS-related issues. Although it appears here as a dev dependency via frontend/build tooling, it becomes dangerous if attacker-controlled CSS, source maps, or config inputs are processed during development or CI.

Known Vulnerable Dependency: rollup==4.57.1 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: rollup 4.57.1 is identified as a vulnerable version with a path traversal arbitrary file write issue. In this project it is a build-time dependency, which reduces likelihood in production but still creates meaningful risk in local development or CI if attacker-controlled bundle inputs, plugins, or paths are involved.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: vite 7.3.1 is a real vulnerable dependency with multiple path traversal and arbitrary file read issues centered on the development server and related asset handling. Because Vite commonly runs network-facing local services during development, this is more dangerous than a passive library issue, especially if the dev server is reachable by other users or used in shared/CI environments.

Known Vulnerable Dependency: @vitest/mocker==4.0.18 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: @vitest/mocker 4.0.18 is a real vulnerable dependency per the cited advisory, but it is present only as a development/testing dependency. In this lockfile context, exploitation would generally require running Vitest mocking features against attacker-controlled test inputs or exposing test tooling in an unsafe environment, so the issue is real but operationally limited.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: esbuild 0.27.3 is flagged for an arbitrary file read issue tied to its development server on Windows. The dependency is real, but in this package-lock it is a dev/build tool and not evidence by itself of production exposure; risk depends on whether the vulnerable dev-server workflow is actually used.

Static analysis

No suspicious patterns detected.