ClawHub
Back to skill

Security audit

Vibesku

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real VibeSKU CLI skill, but it needs review because it can upload local files, persist credentials, send them to a configurable server, and recommends unpinned auto-updates.

Install only if you trust VibeSKU and need this CLI. Before use, confirm every image/logo path is a non-sensitive product asset, avoid letting an agent choose paths automatically, keep VIBESKU_BASE_URL unset unless using a trusted HTTPS or localhost development server, protect ~/.vibesku/config.json, and review any skill update instead of allowing an automatic update from the upstream main branch.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
bin/file-asset.js:12
Finding

Arbitrary Local Files Can Be Uploaded as Image Assets

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
bin/config-store.js:33
Finding

Credentials and Uploaded Files Can Be Sent to an Unrestricted or Plaintext Custom Base URL

Content
View full analysis
") .description("Set the API base URL") .action((url) => { const config = loadConfig(); config.baseUrl = url.replace(/\/$/, ""); saveConfig(config); logger.success(`Base URL set to ${config.baseUrl}`); }); ``` Authenticated requests then send bearer credentials to that destination: ```js const baseUrl = getBaseUrl(); const token = requireAuthToken(); const headers = { Authorization: `Bearer ${token}`, Accept: "application/json" }; let res = await fetch(`${baseUrl}${path}`, { method, headers, body: body !== void 0 ? JSON.stringify(body) : void 0 }); ``` File uploads use the same unrestricted destination: ```js let res = await fetch(`${baseUrl}${path}`, { method: "POST", headers: { Authorization: `Bearer ${token}` }, body: formData }); ``` The documentation explicitly demonstrates plaintext HTTP for custom endpoints: ```bash vibesku init vsk_abc123def456 --base-url http://localhost:3005 vibesku config set-url http://localhost:3005 ``` ### Technical Analysis The CLI does not parse or validate custom base URLs before using them for authentication, token refresh, API requests, and file uploads. It does not enforce HTTPS, constrain plaintext HTTP ...[truncated 2404 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
references/versioning.md:40
Finding

Automatic Update Guidance Trusts Mutable Upstream Content Without Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
The CLI is bundled at `bin/vibesku.js` — self-contained Node.js script, zero dependencies (requires Node >= 18).

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The skill recommends comparing with an upstream source and auto-updating itself before continuing a user task. Self-modification is dangerous because it changes the trusted execution surface at runtime, potentially introducing unreviewed code or prompt content from a remote source and bypassing prior validation of the installed skill.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
- **Full UUID required for refine**: Use `vibesku status <job-id> --json` to get complete output UUIDs (table view truncates them).
- **Agent-friendly output**: Prefer `--json` flag for all commands when used by AI agents.
- **Version drift check (recommended triggers)**: Compare local `VERSION` with upstream when any of these happen: unknown template/option error, template mismatch with `vibesku templates --json`, user asks for newly added capability, or local check is older than 7 days (recommended cadence). If issues occur during execution, prioritize this check before retrying generation/refine commands. Follow [versioning.md](references/versioning.md).
- **Auto-update when outdated (recommended)**: If upstream version is newer, update skill first, then continue the user task with the updated skill.
- **Watch mode**: `--watch` polls every 5s until all runs complete.
- **Credit tracking**: Generation and refine show remaining balance on success.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · bin/vibesku.js (reported line 2585)May include surrounding context.

js
* Parse options from `argv` removing known options,
       * and return argv split into operands and unknown arguments.
       *
       * Side effects: modifies command by storing options. Does not reset state if called again.
       *
       * Examples:
       *

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill explicitly describes networked behaviors such as browser-based authentication, API-key use, uploading product images, checking credits, and exporting remote generation results, yet it declares no tool scope or allowed-tools boundary. This creates an authorization/expectation gap where an agent may invoke network-capable behavior without an explicit permission model, increasing the chance of unintended external requests or data transfer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases are broad enough to match generic product-design or image-generation requests that may not specifically call for this CLI. Over-broad activation can cause the skill to engage unexpectedly, leading to unnecessary network use, file uploads, or credentialed actions in contexts where the user did not intend to use VibeSKU.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow instructs users to upload product images and later export results, but it does not clearly warn that local files will be transmitted to an external service and that output files will be written locally. This weakens informed consent and can result in accidental disclosure of proprietary images, branding assets, or confidential product information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · bin/vibesku.js (reported line 323)May include surrounding context.

js
*/
      subcommandTerm(cmd) {
        const args = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
        return cmd._name + (cmd._aliases[0] ? "|" + cmd._aliases[0] : "") + (cmd.options.length ? " [options]" : "") + // simplistic check for non-help option
        (args ? " " + args : "");
      }
      /**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · bin/vibesku.js (reported line 4708)May include surrounding context.

js
```bash
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "make the background brighter"
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "change to landscape" --aspect-ratio 16:9 --image-size 4K
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "remove watermark" --yes    # Skip confirmation
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "increase contrast" --json
```

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 176)May include surrounding context.

bash
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "make the background brighter"
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "change to landscape" --aspect-ratio 16:9 --image-size 4K
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "remove watermark" --yes    # Skip confirmation
vibesku refine beb47f34-fdf8-49c4-9b9f-96bd367ed145 -p "increase contrast" --json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The parameter table sets primaryLang to zh by default and secondaryLang to en, which imposes a specific language/locale choice on users unless they override it. The document later justifies this as being designed for Chinese e-commerce pages, but the default still forces a locale behavior rather than presenting it as an explicit opt-in choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation description says the template is for e-commerce listings "or general product descriptions," which broadens activation beyond a clear marketplace-listing use case. That phrasing overlaps with common writing requests and does not define boundaries or exclusions, making unintended invocation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The authentication section states that tokens and API keys are stored in configuration files or supplied through environment variables, but it does not provide any caution about local credential storage, file permissions, shell history exposure, or sharing risks. This can lead users to handle secrets unsafely, especially when using commands like init with inline keys.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The formatter forces credit amounts to use the "en-US" locale via toLocaleString("en-US"). For a general-purpose CLI, this imposes a specific locale without user opt-in and may conflict with organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The high-level description says the tool turns product photos into e-commerce visuals and copy, while the code also creates checkout sessions and can open a browser for purchasing credits/subscriptions. Although credits are mentioned later in the use-cases, this monetization flow is not reflected in the core description, creating a mild manifest-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest focuses on generating, refining, exporting, batch runs, credits, authentication, templates, and configuration, but does not mention a standalone capability to browse historical jobs. The code adds jobs and status functionality that enumerates and inspects previous jobs and their outputs, which is broader than the manifest's described workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The embedded CLI description states VibeSKU CLI - AI-powered product image generation, which narrows the apparent intent to images only. Elsewhere in the code, templates and outputs clearly include text outputs and listing copy workflows, so the description understates and contradicts the broader implemented functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The parameter table sets primaryLang to en by default, which imposes a specific language choice in the skill's natural-language behavior. The file does not state that users will be asked to confirm or choose their preferred language before English is used by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.