@vatio-ai/cli@0.130.0
Vatio CLI — deploy and manage Vatio agent workspaces
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI discloses and allows disabling runtime telemetry, but failure reports can still contain user-supplied values or local paths. This is a telemetry privacy risk, not evidence of credential theft or malicious intent.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs a CLI command; reporting occurs when it finishes, including after an error.
Impact
User-provided command values or machine-specific paths may be disclosed in telemetry.
Mechanism
The CLI sends command outcome data and, on errors, an exception message or stack trace to the configured Vatio service. An invalid `vatio init` slug is included in its error message.
AI rationale
The CLI discloses and allows disabling runtime telemetry, but failure reports can still contain user-supplied values or local paths. This is a telemetry privacy risk, not evidence of credential theft or malicious intent.
Evidence
bin/vatio.mjslib/telemetry.mjslib/commands/misc.mjsconfigHome()/telemetry-noticeconfigHome()/sessions.jsonconfigHome()/skills-hint.jsonconfigHome()/skills-check.json
Network endpoints1
vatio.ai/api/developer/v1/cli/events (default; base URL is configurable)
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI runs report command outcomes automatically on completion and on errors.
- Error reports include exception messages or stack traces; `vatio init` can put a user-supplied invalid slug in an exception message.
- Reports are POSTed to the configured Vatio service and include the workspace identifier.
Evidence against
- Telemetry is disclosed and can be disabled with VATIO_TELEMETRY=0 or DO_NOT_TRACK=1.
- The package has a CLI entry point and no lifecycle scripts.
- The AGENTS.md note is written by the explicit `vatio init` command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
10 flaggedlib/skills-hint.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, resolve } from "node:path";
import { confighome } from "./config.mjs";
import { paint } from "./support.mjs";
const skill = "vatio-improve";
const version_file = ".vatio-sk[redacted]";
const latest_url = "https://registry.npmjs.org/@vatio-ai/skills/latest";
const show_every_ms = 24 * 60 * 60 * 1000;
const check_every_ms = 24 * 60 * 60 * 1000;
const fetch_timeout_ms = 1_500;
export async function printskillshint(startdir = process.cwd()) {
if (process.env.ci || process.env.vatio_no_skills_hint) return;
const path = join(confighome(), "sk
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/skills-hint.mjsView on unpkglib/commands/improve.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/commands/improve.mjs#virtual:normalized:round1View on unpkglib/support.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/support.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/support.mjsView on unpkglib/telemetry.mjsView file
•matchType = token_shingles
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/telemetry.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/telemetry.mjsView on unpkglib/codex-session.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/codex-session.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/codex-session.mjsView on unpkglib/commands/workspace-admin.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/commands/workspace-admin.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/commands/workspace-admin.mjsView on unpkglib/update-notice.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/update-notice.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/update-notice.mjsView on unpkglib/commands/identity-key.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/commands/identity-key.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/commands/identity-key.mjsView on unpkglib/release-notes.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/release-notes.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/release-notes.mjsView on unpkglib/docs-sections.mjsView file
•matchType = normalized_sha256
matchedPackage = @vatio-ai/cli@0.126.0
matchedPath = lib/docs-sections.mjs
matchedIdentity = npm:QHZhdGlvLWFpL2NsaQ:0.126.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/docs-sections.mjsView on unpkgFindings
10 High2 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/skills-hint.mjs
HighSemantic Analysis Limitedlib/commands/improve.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritylib/support.mjs
HighKnown Malware Source Similaritylib/telemetry.mjs
HighKnown Malware Source Similaritylib/codex-session.mjs
HighKnown Malware Source Similaritylib/commands/workspace-admin.mjs
HighKnown Malware Source Similaritylib/update-notice.mjs
HighKnown Malware Source Similaritylib/commands/identity-key.mjs
HighKnown Malware Source Similaritylib/release-notes.mjs
HighKnown Malware Source Similaritylib/docs-sections.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @vatio-ai/cli@0.130.0.
See all versions of @vatio-ai/cli for other recorded verdicts.
- Review the evidence and your use of @vatio-ai/cli@0.130.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.