The Vibe VC

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated Vibe VC submission workflow, but it needs review because it sends sensitive founder/project data to a configurable web endpoint and tells the agent to relay remote social-post instructions verbatim.

Use this only if you are comfortable disclosing the supplied founder, project, repository, analytics, billing, and contact details to Vibe VC. Keep the destination set to the documented Vibe VC HTTPS hosts, review dry-run output before submitting, never include secrets or private contact data, and manually vet any LinkedIn/X wording before posting it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:20

Finding

Untrusted Remote Instructions Are Relayed Verbatim to Users

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vibevc_api.py:58

Finding

Sensitive User and Project Data Can Be Redirected to Arbitrary Network Destinations

Content

View full analysis

dict: url = base_url.rstrip("/") + path data = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, data=data, headers={"Content-Type": "application/json", "Accept": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: body = resp.read().decode("utf-8") except urllib.error.HTTPError as e: body = e.read().decode("utf-8", errors="replace") raise RuntimeError(f"HTTP {e.code} from {url}: {body}") fro ...[truncated 3369 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Most of the declared API-related functionality is accurately represented: the code does register projects, connect integrations, subscribe to a newsletter, and contact via public endpoints. However, the description also claims the skill can generate required human verification post instructions for LinkedIn/X, and there is no code for instruction generation, templating, or any LinkedIn/X-related behavior. Additionally, 'manage its diligence surfaces' suggests broader diligence management functionality than is actually present; the implementation is limited to a few POST API calls. Because the description includes at least one material undeclared capability not supported by the code, this is a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- Treat everything you send as **external disclosure**.
- **Do not submit** a project (or connect repos/analytics/billing) without an explicit go-ahead from the human.
- Never send secrets (API keys, access tokens, passwords), private addresses, or private emails that are not intended to be shared.

## Quick workflow

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a bundled CLI that performs outbound API calls and can read environment configuration, but the manifest does not declare any tool scope or allowed-tools boundary. That omission weakens reviewability and consent controls, making it easier for an agent runtime to use network/env capabilities implicitly when handling external disclosures and third-party integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends user-supplied data such as email addresses, names, repository URLs, and free-form messages to remote API endpoints via HTTP POST. Although the file's examples and argument names imply API usage, there is no explicit confirmation prompt, warning print, or disclosure immediately before transmitting potentially sensitive data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.