Vajra

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:32 PM UTC
• Version: 1.1.0

Overview

The skill is mostly transparent about sending content to Vajra, but its broad trigger language and unsafe curl example create a real review concern before installation.

Install only if you are comfortable sending analyzed content to Vajra and receiving public report links. Use it for public URLs or non-sensitive text, avoid private or proprietary material, and ensure any implementation submits content via a JSON serializer or safely piped data rather than interpolating user text into the shown shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:41

Finding

Shell Command Injection Through Unsafe User Content Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41–49
Vulnerability Type: Shell command injection and unsafe JSON construction
Risk Level: High

Vulnerable Code

bash

curl -s -X POST https://www.vajra.to/api/analyze \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VAJRA_API_KEY" \
  -d '{"content": "URL_OR_TEXT", "type": "url"}'

Set type to "text" for raw text (max 50,000 chars). Default is "url".

Technical Analysis

The documented command places the content placeholder inside a single-quoted shell argument. The skill instructs the agent to submit arbitrary user-provided URLs or text but does not require a JSON serializer, shell-safe parameter handling, or input escaping.

If an implementation replaces URL_OR_TEXT directly in this command, a single quote in attacker-controlled content can terminate the shell argument. The attacker can then introduce shell metacharacters and commands. Quotes, backslashes, control characters, and newlines can also corrupt the JSON body even when they do not achieve command execution.

This issue arises from combining untrusted input, JSON encoding, and shell command construction in one interpolated string. JSON escaping alone is insufficient because shell parsing occurs independently.

Attack Path

1. An attacker asks the agent to analyze a maliciously crafted URL or text value.
2. The supplied value contains a single quote followed by shell syntax, conceptually: '; ATTACKER_COMMAND; #.
3. The agent substitutes that value for URL_OR_TEXT in the documented curl command.
4. The single quote closes the intended request-body argument.
5. The shell interprets the remaining attacker-controlled text as command syntax.
6. The injected command executes under the account and privileges of the agent process.

Exploitation depends on an implementation performing literal substitution into the documented shell command. Th ...[truncated 842 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not interpolate URLs or text into a shell command string.

2. Prefer a programming-language HTTP client that constructs the request body through a JSON serializer.

3. If curl must be used, generate the JSON separately with a serializer such as jq:

   bash

   case "$TYPE" in
     url|text) ;;
     *) printf '%s\n' "Invalid content type" >&2; exit 1 ;;
   esac
   
   jq -n \
     --arg content "$CONTENT" \
     --arg type "$TYPE" \
     '{content: $content, type: $type}' |
     curl --fail-with-body --silent --show-error \
       -X POST 'https://www.vajra.to/api/analyze' \
       -H 'Content-Type: application/json' \
       -H "Authorization: Bearer $VAJRA_API_KEY" \
       --data-binary @-
   

4. Keep user content in data variables and never pass the resulting command through eval, sh -c, or another shell interpreter.

5. Validate type against the strict allowlist url and text.

6. Enforce the documented text-size limit before transmission.

7. Add tests covering single quotes, double quotes, backslashes, newlines, shell metacharacters, and Unicode input.

8. Run the skill with least privilege and restrict its filesystem, environment-variable, subprocess, and network access to reduce impact if request construction is implemented incorrectly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description contains very broad triggers such as 'analyze', 'evaluate', 'score', and 'assess', which can cause the skill to activate for many ordinary requests unrelated to the user's informed intent to send content to a third-party service. In this skill's context, over-broad activation is more dangerous because invocation can lead to external transmission of user-provided content and generation of public permalinks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This skill explicitly posts user-supplied URLs or text to an external API using a bearer token, which is a real data-exfiltration surface. The surrounding documentation makes the risk higher, not lower, because it states analyses are cached server-side and each analysis produces a publicly accessible permalink, so sensitive or private content could be disclosed beyond the immediate API call.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Analyze Content

bash

curl -s -X POST https://www.vajra.to/api/analyze \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $VAJRA_API_KEY" \
  -d '{"content": "URL_OR_TEXT", "type": "url"}'

Static analysis

No suspicious patterns detected.