VVVLINK Site Builder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:18 AM UTC
• Version: 1.8.1

Overview

This skill does what it says, but it can create an account, store credentials, and publish user content publicly without a separate confirmation step.

Install only if you are comfortable with the agent creating a VVVLink account, storing an API key under ~/.vvvlink, saving generated site files locally, and publishing your content to a public vvvlink.com URL. Avoid using it with private drafts or confidential business/personal information unless you explicitly want that content made public, and confirm exact site deletion targets before allowing cleanup actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger phrases are extremely broad (including generic terms like "website" and "portfolio"), making accidental invocation likely during unrelated user requests. In an agent environment, that can route ordinary conversations into a skill that creates accounts, writes files, and publishes content externally without the user intentionally selecting it.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill is designed to make generated content publicly accessible online and explicitly normalizes immediate publishing. Without a clear user-facing warning and consent checkpoint, users may unintentionally expose private drafts, personal information, or confidential business content to the public internet.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Only show the drafts line if there are non-live sites.
If the user asks to see or manage drafts, list them with
subdomain, status, and offer to delete individual ones or
all at once via `DELETE /sites/:siteId`.

**If no sites or no API key:**
```

• Confidence: 87% confidence
• Finding: The skill offers deletion of individual or all draft sites via DELETE /sites/:siteId, creating a destructive tool path. Without robust confirmation and precise parameter binding to the user's explicit selection, an agent could delete the wrong site or bulk-delete drafts through misinterpretation or prompt collision.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

---

## DELETE /sites/:siteId

Delete a site and all its versions.

• Confidence: 80% confidence
• Finding: This skill enables a destructive operation that deletes a site and all versions, and in the context of an agent skill that can act on user requests, that raises tool-parameter-abuse risk. If the agent invokes deletion based on ambiguous, manipulated, or insufficiently confirmed input, it could cause irreversible loss of hosted content.

Session Persistence

Medium

• Category: Rogue Agent

Content

description: >
  Build and publish websites on vvvlink.com. Creates HTML sites,
  uploads to VVVLink API, publishes with unique subdomain URLs.
  Triggers on: "create a site", "build a website", "landing page",
  "website", "portfolio", "publish site", "deploy site".
config:
  path: ~/.vvvlink/config.json

• Confidence: 92% confidence
• Finding: The skill persists account credentials and generated site artifacts under the user's home directory, creating a lasting local footprint. Persistence is expected for functionality, but without strong consent and lifecycle controls it can retain sensitive content and authentication material longer than the user realizes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

description: >
    Stores account UUID and API key. Created automatically on
    first use via POST /auth/create_new_user. API key is stored
    with chmod 600 permissions.
persistence:
  - ~/.vvvlink/config.json (account credentials)
  - ~/.vvvlink/sites/<subdomain>/ (generated site files)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

description: >
    Stores account UUID and API key. Created automatically on
    first use via POST /auth/create_new_user. API key is stored
    with chmod 600 permissions.
persistence:
  - ~/.vvvlink/config.json (account credentials)
  - ~/.vvvlink/sites/<subdomain>/ (generated site files)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

description: >
    Stores account UUID and API key. Created automatically on
    first use via POST /auth/create_new_user. API key is stored
    with chmod 600 permissions.
persistence:
  - ~/.vvvlink/config.json (account credentials)
  - ~/.vvvlink/sites/<subdomain>/ (generated site files)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill reads or creates persistent credentials and may automatically create a remote account, but the user is not clearly warned that a new network account and stored API key will be created on first use. This creates consent and privacy issues, especially when broad triggers may invoke the skill unexpectedly.

External Transmission

Medium

• Category: Data Exfiltration

Content

⚡ Building your site with VVVLink Site Builder...

🔍 Searching for photos of [topic]...
[tool call: curl image search]
📸 Found 5 great shots!

🎨 Designing layout with [palette] and [fonts]...

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

> "$VVVLINK_CONFIG"
    chmod 600 "$VVVLINK_CONFIG"
  else
    echo "Error: could not create account" >&2
    exit 1
  fi
fi

• Confidence: 90% confidence
• Finding: This portion of the workflow persists account state created via a remote API and then uses it for subsequent operations. The danger is not mere persistence itself, but that it may happen automatically on invocation, tying the user to a new external account and stored auth material without an explicit consent moment.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Create site
curl -s -X POST https://publish.vvvlink.com/sites \
  -H "Authorization: Bearer $API_KEY"

# Upload each file (from ~/.vvvlink/sites/<subdomain>/)

• Confidence: 93% confidence
• Finding: This code uploads locally generated site files to an external service, which is a real data transmission boundary. While that is the core purpose of the skill, it becomes dangerous because the skill also instructs automatic publishing and broad triggering, increasing the chance that sensitive or unintended content is sent externally without informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Rules

- Publish immediately without asking for confirmation
- For updates to existing sites, mention that the user can
  roll back to a previous version or view version history
- Always offer rename after first publish

• Confidence: 97% confidence
• Finding: The instruction to "Publish immediately without asking for confirmation" gives the agent autonomy over a materially consequential external action: making content public on the internet. Autonomous publication is risky because users may not realize content is going live, and any included personal, business, or confidential information becomes exposed immediately.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Use ONLY bash, curl, and jq. NEVER use python, python3,
  node, ruby, or any other interpreter. There is NO python
  on the server. If you try to use python — IT WILL FAIL.
  Everything can be done with bash + curl + jq.
<ABSOLUTE-BAN>
NEVER EVER put HTML inside bash. This is the #1 cause of
failures and MUST be followed without exception.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

- any bash command containing HTML

REQUIRED — the ONLY correct way:
1. Use your Write/file tool to create the HTML file
2. Then upload it with curl (separate tool call):
   ```bash
   curl -s -X PUT \

• Confidence: 84% confidence
• Finding: The instruction to create HTML files on disk under ~/.vvvlink/sites establishes persistent local storage of generated content. That's functionally necessary, but it still carries privacy risk because site contents may include user-provided personal or business information that remains on disk after publication.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document instructs users to send a bearer API key and later shows an endpoint that returns an API key, but it does not warn readers to treat the key as a secret or avoid sharing/logging it. In markdown documentation, omission of privacy or security warnings around sensitive credentials is a missing user warning.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file describes `DELETE /sites/:siteId` as deleting a site and all its versions, but it provides no warning that the operation is destructive or irreversible. For markdown files, safety-affecting behaviors that could impact user data should include an explicit warning.

Static analysis

No suspicious patterns detected.