Security audit

Vvvv Node Libraries

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent guidance for vvvv gamma library development, but its publishing template could expose a NuGet publishing secret through mutable GitHub Actions references.

Install only if you are working on vvvv gamma node libraries. Before using the generated publishing workflow, pin GitHub Actions to reviewed commit SHAs, restrict workflow permissions, protect the publishing environment, and scope or rotate the NuGet key. Prefer exact NuGet versions or lock files instead of wildcard package versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:186
Finding: Wildcard NuGet Versions Permit Unreviewed Dependency Changes
Content: View full analysis
``` ### Technical Analysis The recommended project configuration uses floating NuGet package versions. The `2025.7.*` pattern allows package restoration to select a future matching release without a corresponding source-code change or explicit review. This weakens build reproducibility and creates a supply-chain exposure. If a publisher account or upstream package is compromised, a malicious matching version could automatically enter subsequent builds. Package installation and build assets can execute logic in a developer environment or CI runner, depending on package contents and build configuration. The finding does not establish that the named packages are malicious. The vulnerability is the unsafe dependency-selection practice presented as the standard project template. ### Attack Path 1. A user applies the `.csproj` template generated from the Skill documentation. 2. The project retains the wildcard package versions. 3. An attacker compromises an upstream publisher or causes a malicious matching package version to be released. 4. A developer or CI runner performs a fresh NuGet restore. 5. NuGet resolves the wildcard to the attacker-controlled release without requiring a repository change. 6. Malicious package or build logic executes in the context of the developer account or build runner. 7. The attacker may tamper with compiled artifacts or access credentials and files available to that build context. ### Impact Assessment Successful exploitation could execute code with the permissions of the developer or CI build account. The accessible ...[truncated 239 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: publishing.md:96
Finding: Mutable GitHub Action References Expose NuGet Publishing Credentials
Content: View full analysis
Remediation: View remediation
# v4.x ``` - Verify action ownership, release provenance, and commit signatures before selecting a SHA. - Place publication behind a protected GitHub environment with required reviewer approval. - Restrict `NUGET_KEY` to the minimum package scope and rotate it periodically. - Prefer trusted publishing or short-lived credentials if supported instead of a long-lived API key. - Set explicit minimal workflow permissions, such as `contents: read`, unless additional access is required. - Separate building and publishing into distinct jobs; publish only immutable, verified artifacts. - Avoid exposing publishing credentials to pull-request workflows or untrusted code. - Use dependency-update tooling to propose reviewed SHA updates. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad and include common requests like creating a package or making a library, which can cause this skill to activate in conversations that are not specifically about vvvv gamma. Unintended invocation can misroute the agent, produce irrelevant guidance, and increase the chance that a user receives incorrect project setup instructions in the wrong context.
Content: No source excerpt is available for this finding.