Vibbit Skills

• Outcome: Review
• Latest audit: Oct 16, 2026 · 4:32 AM UTC
• Version: 2.18.0

Overview

This appears to be a legitimate Vibbit media and product workflow skill, but it merits review because it auto-updates with an unpinned installer and has broad account, media, file, and product-management authority.

Install only if you trust Vibbit and the skill publisher with your product data, media, API account, and local creative files. Consider disabling automatic updates or reviewing updates before use, prefer a host secret manager for API keys, avoid submitting confidential media unless Vibbit processing is acceptable, and confirm product deletions or paid generation requests carefully.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (70)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the implementation performs environment/toolchain discovery, filesystem scanning, PATH executable inspection, or package/module enumeration while presenting itself as a Vibbit creative tool, that is a significant and under-disclosed capability mismatch. Such host reconnaissance can reveal sensitive local context and is especially dangerous because it is not necessary for normal user expectations around media production.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/runtime/skill-updates.md (reported line 15)May include surrounding context.

md

Use `-p` instead of `-g` for a project installation. Apply a total deadline of 20 seconds through the command runner. If it remains running at the deadline, stop that update process before continuing; do not leave it modifying files during production.

Success: reread the installed SKILL.md and only the references needed for the current task, then continue quietly. A file update does not replace instructions already read into the conversation. Report success only when the command confirms an update or that the installation is current. Failure, missing tracking, offline access, or a timeout: briefly say the current local version will be used, and continue if it is usable. Do not loop, update unrelated software, or reject the creative task solely because upgrading failed.

Updates replace distributed instructions, references, and bundled scripts. Account selection and private credentials live outside the Skill and must not be overwritten or included in a release. Updates follow the recorded upstream source/ref, not necessarily the newest GitHub Release. A user-pinned source stays pinned.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/runtime/transcript-tools.md (reported line 74)May include surrounding context.

md

Import valid word files with `production.js import-timing` under [local production](local-production.md), then bind word events. Usually record adopted speech as its own `kind: "audio"` output and import timing for that same file. The run's timing references this audio output, with `at_seconds` defining its program placement; verify the avatar video's soundtrack and synchronization relationship separately.

`media_sha256` belongs to the file associated during normalize. Speech audio and an avatar video have different file hashes; never replace the audio hash with a video hash or remove the check to force import. To use a video as the timing source, obtain/verify evidence for that actual video and its soundtrack relationship. File identity and range checks are not acoustic verification. Dynamic subtitle templates remain unavailable.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises saving scripts, talent, scenes, and other user content in 'private persistent storage' but does not warn users about retention, privacy, or data-handling implications. Given this skill handles potentially sensitive creative assets, product materials, reference media, audio/video, and translated content, omission of a clear disclosure can lead users to submit regulated, proprietary, or personal data without informed consent. The skill context makes this more concerning because long-lived storage and media processing are core features, not incidental behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to install the skill via npx skills add vibbit-ai/skills without pinning an exact package version. That causes execution of whatever version of the skills package is current at install time, creating a supply-chain risk if a malicious or compromised update is published. Because this command is run in the agent's actual execution environment, the blast radius can include credential theft or arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The update command uses npx --yes skills@latest update vibbit-skills -y, explicitly tracking latest. This means future updates automatically execute newly published code with no version review, which is a classic supply-chain exposure if the package or publishing account is compromised. In a skill ecosystem, update commands are especially sensitive because users may trust them and run them repeatedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes saving user-provided scripts, models, scenes, and product information in a private persistent directory, but provides no warning about privacy, retention, or handling of potentially sensitive commercial content. In this skill's context, persistent storage is central to reuse workflows, so users may unknowingly store confidential assets or personal data longer than intended, increasing exposure from compromise, misuse, or accidental sharing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to execute npx skills add vibbit-ai/skills without pinning a specific package version. Because npx resolves and runs the latest published package by default, a compromised upstream package, malicious update, or dependency hijack could cause arbitrary code execution during installation in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README tells users to connect a Vibbit account for verification but does not warn that authentication and subsequent use will share data with an external service. Given this skill processes product links, scripts, media, and possibly account-linked assets, lack of disclosure can cause users to expose sensitive business content or personal data without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The update command npx --yes skills@latest update vibbit-skills -y explicitly pulls and executes the latest version of the skills package, increasing supply-chain risk. If the package or one of its dependencies is compromised, users may execute attacker-controlled code simply by following the README update instructions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill directs authentication, site selection, API usage, and external operations, but the manifest shown does not declare an explicit tool scope such as allowed tools or permissions. That creates a least-privilege failure: an agent/runtime may grant broader environment or network access than users would infer from the skill declaration, increasing the blast radius if the skill or referenced modules behave unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default prompt describes a very large set of unrelated capabilities, from product-link ingestion to media generation, transcription, translation, and novel-to-comic adaptation, without clear invocation boundaries. This broad scope increases the chance of accidental or inappropriate routing, where ordinary user requests could trigger a powerful skill with access to external actions or sensitive content-processing workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Enabling implicit invocation without narrowing context or a strict trigger list allows the system to auto-select this skill for loosely related requests. Because this skill spans product management, research, content adaptation, and media-production tasks, implicit activation can cause unintended execution, over-collection of user data, or unreviewed downstream actions in cases where the user did not clearly request this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest hard-codes the target language to English via the "target_language" field, and the listed target_languages entry also fixes output to "en". For a file type covered by policy checks, this is a natural-language locale constraint with no visible user choice, opt-in, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The per-item configuration restricts target output to "en", reinforcing an English-only locale policy. Because the file provides no indication that users can select another language or that the constraint is justified by a region-specific purpose, this matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs users to provide a publicly reachable or otherwise accessible video_url to an external service, but it does not warn that the referenced media may be transmitted to and processed by a third-party API. In a skill focused on product, media, and video workflows, users may submit proprietary marketing assets, customer content, or unpublished media, creating a meaningful privacy and confidentiality risk through omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The command examples show how to invoke the client against a remote API, including a non-dry-run submission path, but they do not clearly warn that running the command may upload or expose media metadata/content to external processing systems and may consume account-scoped resources. Because this skill is specifically designed for media production workflows, users are more likely to run these commands on sensitive business assets, increasing the chance of unintended disclosure or compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents a delete operation that can remove product data, but it does not clearly warn the user that the action is destructive or potentially irreversible. Although it says to call only for an explicit deletion request, that is operational guidance rather than a direct user-facing warning about impact.

Content

No source excerpt is available for this finding.