Vela Dev

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for Vela app development, but its normal workflow repeatedly runs unpinned npm tooling that may fetch and execute changing third-party code.

Install only if you are comfortable with the agent running npm/npx build tooling in your project. Prefer pinning `aiot-toolkit`, committing a lockfile, installing with a reproducible command such as `npm ci`, and using a local executable or `npx --no-install` before letting the skill build projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: assets/template/package.json:6

Finding

Unpinned Build Dependency and Runtime Package Resolution

Content

View full analysis

&& npx aiot build` ``` `SKILL.md:44-47`: ```md After each meaningful edit: - Run `npx aiot build` - If needed, filter logs with grep for `success|error|Error` ``` `references/dev-workflow.md:19-29`: ```sh cd npx aiot build ``` ```sh cd && npx aiot build 2>&1 | grep -E "success|error|Error" ``` `references/ux-gotchas.md:32-36`: ```md Useful commands: - `cd && npx aiot build` - `cd && npx aiot build 2>&1 | grep -E "success|error|Error"` - `cd && npx aiot build 2>&1 | grep -E "error|Error|:" | tail -20` ``` ### Technical Analysis The template specifies `aiot-toolkit` with the caret range `^2.0.5` and does not include a package lockfile. This permits compatible future package versions to be selected without those versions having been reviewed as part of this audit. The documented workflow repeatedly invokes `npx aiot build`. When the expected local executable is unavailable, `npx` may perform registry resolution and retrieve executable package content rather than failing closed. The instructions do not use `--no-install`, verify that the executable came from the declared `aiot-toolkit` dependency, or validate package integrity. Node.js command-line packages and installation lifecycle hooks execute with the permissions of the account running npm. Therefore, an unexpectedly resolved, compromised, or substituted package could execute arbitrary code during a routine build. ### Attack Path 1. A user or agent cre ...[truncated 1578 chars]

Remediation

View remediation

npm ci npx --no-install aiot build ``` 5. Verify the dependency's publisher, source repository, integrity metadata, and transitive dependency changes before updating the pinned version or lockfile. 6. Consider disabling package lifecycle scripts during dependency installation where compatible with the toolkit: ```sh npm ci --ignore-scripts ``` If lifecycle scripts are required, review them before permitting execution. 7. Use a trusted, explicitly configured npm registry and apply dependency scanning or allowlisting in automated build environments. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs use of npx aiot without pinning an exact package version, which causes the environment to fetch and execute whatever package version is current at runtime. If the upstream package is compromised, typo-squatted, or changed incompatibly, this can result in arbitrary code execution during build steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This line operationally tells the agent to run cd <project> && npx aiot build, again relying on an unpinned package resolution path. Because npx may download and execute code on demand, a malicious or newly published package version could execute with the agent's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The build/debug loop repeatedly instructs running npx aiot build, multiplying exposure to unpinned remote code execution risk each time the loop is followed. In an agent setting, repetition increases the chance that transient package registry compromise or version drift leads to execution of untrusted code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This instruction says to run npx aiot build after each meaningful edit, which is a classic supply-chain hazard because the command may execute an unverified package version. In a development automation skill, that means normal usage directly triggers risky behavior rather than merely mentioning the command academically.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx aiot build without pinning a version causes package resolution to depend on whatever version is current in the registry or cache at execution time. In a developer workflow skill, this can expose users to supply-chain risk, including malicious package updates, dependency confusion, or unexpected behavior from silently changed tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The command npx aiot build 2>&1 | grep -E "success|error|Error" still performs an unpinned npx package fetch/execute, so it carries the same supply-chain exposure as the simpler build command. Because this is presented as a troubleshooting workflow, users may run it directly and repeatedly, increasing the chance of executing an unintended or compromised package version.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation recommends running npx aiot build without pinning a package version, which can cause users to execute whatever version of aiot is currently published or resolved at runtime. If the package is compromised, typosquatted, or changed incompatibly, this can lead to arbitrary code execution on the developer machine or supply-chain compromise during build workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command again instructs use of npx aiot without a pinned version, adding the same supply-chain risk while also normalizing repeated unsafe invocation in troubleshooting steps. Because npx may fetch and run package code, an attacker controlling or poisoning the package source could execute code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The unpinned npx aiot invocation on this line presents the same dependency-execution risk: users may run an unexpected or malicious package version during debugging. In this skill context, the danger is somewhat elevated because the file provides concrete copy-paste build commands, increasing the likelihood that users execute them directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The notes instruct use of npx aiot build without pinning a specific package version, which can cause execution of whatever version npx resolves at runtime. If the upstream package is updated maliciously, compromised, or introduces breaking behavior, users of the skill could run unreviewed code during build steps.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency uses a caret range (^2.0.5), which allows newer minor and patch versions to be installed without review. This can introduce supply-chain risk because future releases of aiot-toolkit could contain malicious code, compromised transitive dependencies, or breaking behavior that affects builds in this skill's template workflow.

Content

Scanner excerpt · assets/template/package.json (reported line 8)May include surrounding context.

json

"build": "aiot build"
  },
  "devDependencies": {
    "aiot-toolkit": "^2.0.5"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document presents official entry points only in Chinese-labeled form and links to /zh/ documentation paths, which can impose a specific language/locale on users without opt-in. This is a natural-language policy concern because the file does not indicate that Chinese is optional or provide alternative locale guidance.

Content

No source excerpt is available for this finding.