Security audit

MyVibe Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real MyVibe publisher, but it has review-worthy credential handling and mutable package execution risks.

Install only if you are comfortable giving this skill MyVibe account publish authority and letting it run networked Node tooling. Prefer the default https://www.myvibe.so hub, avoid custom hubs when VIBE_HUB_ACCESS_TOKEN is set, review any global npm install request, and rotate tokens if you previously used this skill with an untrusted hub.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/auth.mjs:20
Finding: Environment Access Token Can Be Disclosed to an Arbitrary Hub
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/utils/generate-screenshot.mjs:279
Finding: Unpinned Remote Packages Are Downloaded and Executed During Screenshot Generation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:201
Finding: Skill Instructions Mandate Subscription Promotion in Agent Responses
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (53)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
| Has `package.json` with build script, no output | **Buildable** | → Step 2 (build first) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
| Has `package.json` with build script, no output | **Buildable** | → Step 2 (build first) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
| Has `package.json` with build script, no output | **Buildable** | → Step 2 (build first) |

Known Vulnerable Dependency: @grpc/grpc-js==1.14.3 — 2 advisory(ies): CVE-2026-48068 (@grpc/grpc-js: A malformed request can cause a server crash); CVE-2026-48069 (@grpc/grpc-js: An incoming malformed compressed message can cause a client or se)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile pins @grpc/grpc-js 1.14.3, which is flagged with malformed-request and malformed-compression crash advisories. Even though this is a transitive dependency, shipping a vulnerable version can expose denial-of-service conditions anywhere the package is used by included tooling or local services.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: @hono/node-server 1.19.9 is reported vulnerable to middleware bypass and path traversal issues in static file serving. This is particularly relevant in an agent/tooling ecosystem because several bundled dependencies expose local web servers, making route protection or static asset access bypass plausible if those components are ever started.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @isaacs/brace-expansion==5.0.0 — 1 advisory(ies): CVE-2026-25547 (@isaacs/brace-expansion has Uncontrolled Resource Consumption)

High

Category: Supply Chain
Confidence: 94% confidence
Finding: @isaacs/brace-expansion 5.0.0 is flagged for uncontrolled resource consumption, which can enable denial of service through pathological pattern expansion. In this skill context it is likely only reachable via file globbing/tooling features, so exploitation depends on attacker influence over glob patterns but remains a real supply-chain risk.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.25.3 — 1 advisory(ies): CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: @modelcontextprotocol/sdk 1.25.3 is flagged for cross-client data leakage via shared server/transport state. In an agent skill ecosystem this context makes the issue more serious because MCP-style transports may mediate multiple clients, tools, or sessions, raising the risk of boundary failures between users or tasks.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @opentelemetry/exporter-prometheus==0.205.0 — 1 advisory(ies): CVE-2026-44902 (Prometheus exporter process crash via malformed HTTP request)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: @opentelemetry/exporter-prometheus 0.205.0 is flagged for process crash via malformed HTTP requests. Because observability stacks often expose an HTTP metrics endpoint, this can create a practical remote denial-of-service condition if the endpoint is reachable, even if only on local networks.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @opentelemetry/propagator-jaeger==2.1.0 — 1 advisory(ies): CVE-2026-59892 (OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled )

High

Category: Supply Chain
Confidence: 94% confidence
Finding: @opentelemetry/propagator-jaeger 2.1.0 is reported vulnerable to denial of service through malformed propagation data. If Jaeger propagation is enabled anywhere in the bundled tooling, untrusted trace headers could trigger failures during request handling or telemetry processing.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @opentelemetry/sdk-node==0.205.0 — 1 advisory(ies): CVE-2026-44902 (Prometheus exporter process crash via malformed HTTP request)

High

Category: Supply Chain
Confidence: 94% confidence
Finding: @opentelemetry/sdk-node 0.205.0 inherits the Prometheus exporter crash risk because it bundles/exporter integrations that may expose the vulnerable HTTP endpoint. In a toolchain with optional local servers and observability features, this broadens the attack surface beyond a single package entry.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 16)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 18)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 41)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 43)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 57)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 73)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/auth.mjs (reported line 76)May include surrounding context.
js
const TOKEN_KEY = "VIBE_HUB_ACCESS_TOKEN"; /** * Get cached access token for a given hub URL * @param {string} hubUrl - The MyVibe URL * @returns {Promise<string|null>} - The cached access token or null */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/http.mjs (reported line 8)May include surrounding context.
js
* Make an authenticated API request * @param {string} url - Request URL * @param {Object} options - Fetch options * @param {string} accessToken - Access token * @param {string} hubUrl - Hub URL (for error handling) * @returns {Promise<Object>} - Response data */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/http.mjs (reported line 90)May include surrounding context.
js
* Make an authenticated API request * @param {string} url - Request URL * @param {Object} options - Fetch options * @param {string} accessToken - Access token * @param {string} hubUrl - Hub URL (for error handling) * @returns {Promise<Object>} - Response data */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/http.mjs (reported line 182)May include surrounding context.
js
* Make an authenticated API request * @param {string} url - Request URL * @param {Object} options - Fetch options * @param {string} accessToken - Access token * @param {string} hubUrl - Hub URL (for error handling) * @returns {Promise<Object>} - Response data */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/upload-image.mjs (reported line 65)May include surrounding context.
js
* Make an authenticated API request * @param {string} url - Request URL * @param {Object} options - Fetch options * @param {string} accessToken - Access token * @param {string} hubUrl - Hub URL (for error handling) * @returns {Promise<Object>} - Response data */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/upload.mjs (reported line 15)May include surrounding context.
js
* Make an authenticated API request * @param {string} url - Request URL * @param {Object} options - Fetch options * @param {string} accessToken - Access token * @param {string} hubUrl - Hub URL (for error handling) * @returns {Promise<Object>} - Response data */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/upload.mjs (reported line 191)May include surrounding context.
js
* Make an authenticated API request * @param {string} url - Request URL * @param {Object} options - Fetch options * @param {string} accessToken - Access token * @param {string} hubUrl - Hub URL (for error handling) * @returns {Promise<Object>} - Response data */

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/store.mjs (reported line 10)May include surrounding context.
js
const SERVICE_NAME = "myvibe-publish"; /** * Create a secret store for storing access tokens * Uses system keyring when available, falls back to file storage */ export async function createStore() {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils/store.mjs (reported line 11)May include surrounding context.
js
/** * Create a secret store for storing access tokens * Uses system keyring when available, falls back to file storage */ export async function createStore() { const filepath = join(homedir(), ".aigne", CONFIG_FILENAME);

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/utils/generate-screenshot.mjs:188

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/utils/auth.mjs:124