@vatio-ai/cli@0.72.0
Vatio CLI — deploy and manage Vatio agent workspaces
AI Security Review
scanned 25d ago · by lpm-firewall-aiSession sharing conditionally forwards the existing Vatio token to an unrestricted configured destination, which presents a concrete credential exposure risk even though the command requires user invocation and ordinarily asks for confirmation. The agent-related writes inspected are explicit setup or local hint state and do not establish a separate attack.
Static reason
No blocking static signals were detected.
Trigger
A user runs `vatio share-session` and confirms sending, or invokes it with `--yes`, with a token configured.
Impact
A non-Vatio destination could receive the token and transcript, allowing credential misuse and disclosure of session content.
Mechanism
The command posts the transcript to a path under the configured base URL and places the configured token in the Authorization header; the base URL is not restricted in the inspected source.
AI rationale
Session sharing conditionally forwards the existing Vatio token to an unrestricted configured destination, which presents a concrete credential exposure risk even though the command requires user invocation and ordinarily asks for confirmation. The agent-related writes inspected are explicit setup or local hint state and do not establish a separate attack.
Evidence
lib/config.mjslib/commands/support-commands.mjs
Network endpoints2
vatio.aiVATIO_BASE_URL or configured base_url
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `share-session` sends a Claude Code transcript and attaches the token returned by `resolveToken()` as a Bearer credential.
- The request destination comes from `VATIO_BASE_URL` or the configured `base_url`; the source shows no destination restriction.
- Transcript sending requires explicit `--yes` or an interactive affirmative response, and requires authorization.
- The package’s agent configuration write is performed by the explicit `init` command; the skills hint checks for existing skills and plugins.
- The skills hint’s state write records when the hint was shown; it does not install or alter agent configuration.
Evidence against
- The manifest exposes a CLI executable and declares no install lifecycle hooks.
- Session sharing is an explicit command with a confirmation gate unless the caller supplies `--yes`.
- The default service destination is Vatio’s `https://vatio.ai` endpoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedlib/skills-hint.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, resolve } from "node:path";
import { confighome } from "./config.mjs";
import { paint } from "./support.mjs";
const skill = "vatio-improve";
const show_every_ms = 24 * 60 * 60 * 1000;
export function printskillshint(startdir = process.cwd()) {
if (process.env.ci || process.env.vatio_no_skills_hint) return;
if (sk[redacted](startdir)) return;
const path = join(confighome(), "sk[redacted]");
const key = resolve(startdir);
const state = readstate(path);
const last = date.parse(state[key] ?? "");
if (!number.isnan(last) && date.no
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/skills-hint.mjsView on unpkglib/commands/support-commands.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
Findings
2 High6 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/skills-hint.mjs
HighSemantic Analysis Limitedlib/commands/support-commands.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/commands/support-commands.mjs
MediumAi Review Evidencelib/config.mjs
MediumAi Review Evidencelib/config.mjs
MediumAi Review Evidencelib/commands/support-commands.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @vatio-ai/cli@0.72.0.
See all versions of @vatio-ai/cli for other recorded verdicts.
- Review the evidence and your use of @vatio-ai/cli@0.72.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.