Vefaas Cli

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:59 PM UTC
• Version: 1.0.6

Overview

The skill appears to be a legitimate veFaaS deployment helper, but it needs review because it installs an unpinned global CLI and encourages noninteractive cloud deployments and sensitive secret/log handling with limited guardrails.

Install only if you trust the Volcengine CLI distribution channel and are comfortable with a global, auto-updating deployment tool. Use least-privilege Volcengine credentials, verify the target app/region before any deploy or push, avoid `--yes` for production unless you have separate approval controls, review files and ignore rules before uploading code, and redact debug logs and `.env` contents before sharing or importing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Mutable and Unverified Global CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-29
Vulnerability Type: Mutable third-party dependency without integrity verification
Risk Level: Medium

Vulnerable Code

yaml

install:
  kind: tarball
  url: https://vefaas-cli.tos-cn-beijing.volces.com/volcengine-vefaas-latest.tgz
  bin: vefaas

bash

npm i -g https://vefaas-cli.tos-cn-beijing.volces.com/volcengine-vefaas-latest.tgz

Technical Analysis

The Skill globally installs a tarball identified by the mutable name volcengine-vefaas-latest.tgz. The documentation does not pin an immutable version or require validation through a checksum, package integrity value, or cryptographic signature.

Although the source is described as Volcengine's official distribution channel and HTTPS protects data in transit, it does not guarantee that the retrieved package remains identical to the package originally reviewed. The effective executable payload can change whenever the remote latest artifact is replaced.

A globally installed npm package may also execute package lifecycle scripts during installation. After installation, the CLI operates with access to declared Volcengine credentials and local project files. This creates a significant supply-chain trust boundary.

Attack Path

1. An attacker compromises the distribution endpoint, publishing process, DNS infrastructure, or credentials used to update the remote tarball.
2. The attacker replaces volcengine-vefaas-latest.tgz with a modified package.
3. A user or AI agent follows the documented global installation command.
4. Malicious package lifecycle code or modified CLI code executes with the privileges of the installing user.
5. The package accesses available Volcengine credentials, local deployment source, or build artifacts.
6. The compromised CLI can exfiltrate data, alter cloud deployments, or perform unauthorized cloud operations within the credentials' permissions.

...[truncated 695 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest URL with an immutable, explicitly versioned release artifact.
2. Publish a SHA-256 or stronger checksum through a separately protected release channel and verify it before installation.
3. Prefer a signed package and require cryptographic signature verification against a pinned publisher key.
4. If the CLI is distributed through a package registry, use an exact version and validated package integrity metadata.
5. Disable or carefully review npm lifecycle scripts where operationally possible.
6. Avoid automatic global installation. Install the CLI in an isolated environment with minimum filesystem and network privileges.
7. Document a controlled update procedure in which every new CLI release is reviewed before the pinned version and integrity value are changed.
8. Limit the Volcengine identity used by the CLI to the minimum permissions required for the intended deployment operation.

T09 · Insecure Skill Coding Practices

Note

• Location: references/troubleshooting.md:14

Finding

Raw Debug Log Collection May Disclose Credentials and Sensitive Deployment Data

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md:14-24 and references/troubleshooting.md:122-139
Vulnerability Type: Sensitive information exposure through diagnostic logs
Risk Level: Low

Vulnerable Code

markdown

Debug mode outputs:
- **Framework detection**: Detected framework, runtime, build command
- **Shell execution**: Commands, working directory, exit codes
- **Packaging**: Ignore rules, file count, package size
- **HTTP requests/responses**: API call parameters and results

## Debug Log Files

Debug logs are automatically saved to files:

bash

# Log file location
~/.vefaas/logs/YYYYMMDD-HHMMSS.txt

markdown

Log files contain full JSON response data (terminal shows preview only).

markdown

## Submit Feedback

If issues persist, collect this information:

bash

# 1. CLI version
vefaas --version

# 2. Debug log
vefaas --debug <command> 2>&1 | tee debug.log

# 3. Latest log file
cat ~/.vefaas/logs/$(ls -t ~/.vefaas/logs/ | head -1)

# 4. Environment info
node -v
uname -a

markdown

Include:
- Operating system version
- Node.js version
- Project framework type

Technical Analysis

The troubleshooting guide states that debug mode records HTTP request and response parameters and that saved logs contain full JSON response data. It then instructs users to collect raw terminal output and the latest saved log when submitting feedback.

API diagnostics can contain authentication tokens, access identifiers, environment values, application configuration, internal URLs, resource identifiers, or sensitive response data. The collection procedure does not include a mandatory sanitization step before the files are disclosed.

SKILL.md:132-133 separately warns that debug output may contain secrets and requires redaction. This warning partially mitigates the issue, but it is not repeated ...[truncated 1491 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an explicit mandatory redaction warning immediately before the feedback-collection commands.
2. Instruct users not to publish or attach raw debug logs.
3. Provide a supported diagnostic-export command that removes secrets, tokens, authorization headers, cookies, environment values, and sensitive request or response fields.
4. Configure the CLI to redact sensitive values before writing logs, rather than relying solely on manual review.
5. Mask common secret patterns, including access keys, secret keys, bearer tokens, session tokens, passwords, connection strings, and signed URLs.
6. Store logs with owner-only permissions and document a short retention period and secure deletion procedure.
7. Recommend secure, access-controlled support channels for sanitized diagnostic artifacts.
8. Replace direct cat instructions with a sanitization workflow that creates a separate reviewed copy for submission.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

vefaas --version

text

> **Tip**: `vefaas -v` (or `vefaas --version`) will print the current version and, if a newer release is available, show instructions on how to update. When a user encounters unsupported features or wants to check for updates, run this command first.

## Core Workflow

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

| Option | Description |
|--------|-------------|
| `-d, --debug` | Enable debug mode for troubleshooting |
| `--yes` | Non-interactive mode (required for CI/AI coding) |
| `--region` | Region override (e.g., cn-beijing) |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cookbooks/deploy-existing-code.md (reported line 71)May include surrounding context.

vefaas env set DATABASE_URL "postgres://user:pass@host:5432/db" vefaas env set API_KEY "your-api-key"

Or import from .env file

vefaas env import ./.env.prod

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The example vefaas env import .env encourages bulk importing secrets from a .env file without any guardrails about credential handling, file protection, or accidental inclusion of sensitive local development secrets. Because .env files often contain API keys, tokens, and database credentials, this can facilitate credential exposure or unsafe propagation of secrets into remote environments.

Content

Scanner excerpt · cookbooks/manage-functions.md (reported line 89)May include surrounding context.

Import from File

bash

vefaas env import .env

Scenario D: View and Update Configuration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/configuration.md (reported line 98)May include surrounding context.

text

# Local config
*.local
.env.local

# Dependencies
node_modules/

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · cookbooks/manage-functions.md (reported line 132)May include surrounding context.

md

# Troubleshooting Reference

## Enable Debug Mode

When encountering issues, first enable debug mode with `--debug` or `-d`:

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 3)May include surrounding context.

md

# Troubleshooting Reference

## Enable Debug Mode

When encountering issues, first enable debug mode with `--debug` or `-d`:

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 5)May include surrounding context.

Enable Debug Mode

When encountering issues, first enable debug mode with --debug or -d:

bash

vefaas --debug deploy

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The deployment example uses a one-liner with --yes and does not clearly warn that the CLI will perform a local build and then package and upload project code to a remote veFaaS service. In a security-sensitive skill, this omission can cause users or downstream agents to transmit proprietary code and bundled secrets non-interactively without realizing the scope of the action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The environment-variable import instructions tell users to run vefaas env import ./.env.prod and include example secrets, but they do not warn that all values in the file will be uploaded to the remote platform and stored there. This creates a real risk of unintentionally transferring production credentials, over-sharing unrelated secrets, or normalizing unsafe handling of sensitive configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The redeploy and push examples modify code or upload changes to an existing remote function, but the documentation does not warn that these commands can alter production behavior or overwrite live code. In an infrastructure-management skill, omission of a change-impact warning can lead to accidental service disruption, unintended releases, or propagation of unsafe changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cookbook demonstrates listing, retrieving, and importing environment variables that commonly contain secrets such as DATABASE_URL and API_KEY, but it provides no warning about secret sensitivity, terminal exposure, shell history, or accidental logging. In an agent skill context, users may copy these commands verbatim, increasing the chance of credential disclosure or unsafe secret handling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The deploy example includes --yes, which suppresses confirmation for a remote deployment that can upload local build artifacts and modify live serverless configuration. In a deployment-management skill, normalizing auto-confirmed destructive or externally affecting commands without an explicit warning increases the chance that an agent or user triggers unintended remote changes, especially in automated contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The troubleshooting guidance again recommends vefaas deploy ... --yes without warning that the command may rebuild locally, upload code, and alter a remote deployed function. Because this skill is specifically for managing veFaaS deployments, such examples are more dangerous than generic shell snippets: they can directly encourage unattended or accidental production-affecting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting guidance explicitly states that debug mode captures shell execution details and HTTP requests/responses, but it does not warn that these logs may include secrets, tokens, request payloads, paths, and other sensitive operational data. In a deployment tool handling cloud credentials and function configuration, users may enable debug mode and store or share logs without realizing the exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file instructs users to collect and share full debug output and the latest log file, while earlier stating that log files contain full JSON response data. Without a redaction warning, users may disclose API responses, account identifiers, tokens, environment variables, or other sensitive deployment metadata to support channels or third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown documents commands that pull configuration from the cloud, while earlier stating that configuration is stored in .vefaas/config.json under the project root. It does not warn users that running these commands will write or overwrite local project configuration, which is a user-data-affecting behavior relevant to safety and transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.