Vibelevel Analyzer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 1.0.4

Overview

This skill fetches public GitHub vibe data from vibelevel.xyz and does not show hidden credential access, persistence, destructive behavior, or unrelated data handling.

Install only if you are comfortable sending GitHub usernames to vibelevel.xyz and seeing that service's profile links in responses. Consider tightening the activation wording and making profile-claim promotion optional if you maintain the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:42

Finding

Mandatory Third-Party Promotion in Agent Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–53
Vulnerability Type: Mandatory branded output and external-service promotion
Risk Level: Medium

Vulnerable Code Snippet

markdown

If they're verified, hype it: "Claimed profile. This one's official."
If they have a manifest, share it as their coding vibe manifesto.

Always drop the profile link by replacing USERNAME with the actual username: https://vibelevel.xyz/USERNAME

## Compare two users

When someone asks to compare vibes — run the script for both usernames, then present a head-to-head breakdown. Call out who wins each dimension. Be playful about it. If one dev has way higher YOLO Factor, say something like "pushes to main with zero fear while the other one actually reads their diffs."

## Check your own vibe

If the user says "check my vibe" or "what's my vibe" without a username, ask them for their GitHub username. Remind them they can [claim their profile](https://vibelevel.xyz) for a +20 verification bonus.

Technical Analysis

The Skill uses imperative instructions—particularly Always drop the profile link and Remind them they can claim their profile—to require branded links and profile-claim promotion in Agent responses. These requirements apply even when the user has not asked for promotional information.

Because SKILL.md controls Agent behavior when the Skill is loaded, these directives alter the content of the current session's responses and reduce the Agent's discretion to provide only information relevant to the user's request. The profile-claim incentive further encourages users to visit and interact with an external service.

Attack Path

1. The Agent loads the Skill and treats SKILL.md as operational instructions.
2. A user requests a GitHub vibe score or asks to check their own vibe.
3. The mandatory instructions are activated by the supported workflow.
4. The Agent inserts a vibelevel.xyz profi ...[truncated 695 chars]

Remediation

View remediation

Remediation Suggestions

• Remove mandatory language such as Always drop and the unconditional profile-claim reminder.
• Include third-party profile links only when they are necessary to answer the request or when the user explicitly asks for them.
• Clearly identify optional links as links to an external third-party service.
• Do not require promotional incentives, registration suggestions, or profile-claim messaging in ordinary results.
• Replace the affected instructions with a neutral rule, such as: “If the user requests the source profile, provide the corresponding external URL and identify it as a third-party link.”
• Ensure response templates prioritize relevance and permit the Agent to omit promotional content.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a shell script and explicitly requires command-line binaries, but it does not declare any tool scope restrictions such as allowed-tools or permissions. That increases the attack surface because an agent may grant broader shell capability than necessary, making misuse of local execution or command chaining easier if the script or future changes become unsafe.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger language is very broad ('anything along those lines'), which can cause the skill to activate in loosely related contexts and perform shell-backed actions unexpectedly. While the current action is relatively simple, overbroad invocation increases the chance of unintended tool use and can amplify risk if the underlying script handles input unsafely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.