Ai Sdk Core

• Outcome: Pass
• Latest audit: May 27, 2026, 9:49 PM
• Version:
  0.1.0

Overview

This is a coherent documentation and template skill for Vercel AI SDK, with some examples users should harden before using in production.

Safe to install as a documentation/template skill. Before copying examples into production, protect API keys, avoid logging raw prompts or provider responses, add privacy disclosure for data sent to AI providers, and tightly scope any MCP or filesystem tools.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The security guidance is misleading because it presents simple string replacements and truncation as a way to 'remove potential prompt injections,' which does not meaningfully defend against prompt injection attacks. Developers may rely on this pattern, creating a false sense of safety and exposing downstream tool use, data access, or system-prompt-controlled behavior to manipulation by crafted inputs.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README defines an extremely broad set of auto-trigger keywords covering generic AI, SDK, provider, framework, and error terms. In an agent ecosystem, this can cause the skill to be selected for loosely related tasks, increasing the chance of inappropriate invocation, context pollution, or unreviewed guidance being applied where a more specific skill should handle the request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The logging examples capture full prompt content, arbitrary context, stack traces, response bodies, and then serialize them to console/monitoring systems. In production, prompts and error payloads often contain sensitive user data, secrets, provider responses, or internal metadata, so this pattern can cause unintended data exposure through logs and third-party observability platforms.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The extractContactInfo server action sends arbitrary user-provided text to an external AI provider for contact extraction, which can include personal data such as names, email addresses, phone numbers, and company details. In this template there is no accompanying consent flow, disclosure, minimization, or guardrail indicating that PII will be transmitted off-platform, creating privacy, compliance, and data-handling risk.

VirusTotal

66/66 vendors flagged this skill as clean.