@vatio-ai/cli@0.81.0
Vatio CLI — deploy and manage Vatio agent workspaces
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe explicit init command writes behavior-bearing guidance into a coding-agent control file, which warrants a warning under the agent configuration policy. Its project-scoped, Vatio-specific behavior does not establish an unconsented installation-time attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the init command in a project.
Impact
The note can influence later coding-agent behavior in that project; the inspected source shows no broader or installation-time agent configuration change.
Mechanism
The init handler writes a Vatio note to AGENTS.md, or appends it when the existing file does not already mention Vatio.
AI rationale
The explicit init command writes behavior-bearing guidance into a coding-agent control file, which warrants a warning under the agent configuration policy. Its project-scoped, Vatio-specific behavior does not establish an unconsented installation-time attack.
Evidence
bin/vatio.mjslib/commands/misc.mjsAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes the CLI through a bin entrypoint.
- The CLI routes the explicit init command to its init handler.
- Init calls the project AGENTS.md writer.
- The AGENTS.md note points agents to Vatio documentation and workflow commands.
- The writer only targets AGENTS.md in the project and leaves a file alone if it already mentions Vatio.
- The skills hint checks installed plugin metadata and is called from an improve command.
Evidence against
- The AGENTS.md change requires a user to run init and is limited to a Vatio-specific project note.
- The skills hint checks installation state and records hint state; it does not install or modify agent extensions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedlib/skills-hint.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, resolve } from "node:path";
import { confighome } from "./config.mjs";
import { paint } from "./support.mjs";
const skill = "vatio-improve";
const version_file = ".vatio-sk[redacted]";
const latest_url = "https://registry.npmjs.org/@vatio-ai/skills/latest";
const show_every_ms = 24 * 60 * 60 * 1000;
const check_every_ms = 24 * 60 * 60 * 1000;
const fetch_timeout_ms = 1_500;
export async function printskillshint(startdir = process.cwd()) {
if (process.env.ci || process.env.vatio_no_skills_hint) return;
const path = join(confighome(), "sk
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/skills-hint.mjsView on unpkglib/commands/support-commands.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
Findings
3 High5 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/skills-hint.mjs
HighSemantic Analysis Limitedlib/commands/support-commands.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltabin/vatio.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencebin/vatio.mjs
MediumAi Review Evidencelib/commands/misc.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @vatio-ai/cli@0.81.0.
See all versions of @vatio-ai/cli for other recorded verdicts.
- Review the evidence and your use of @vatio-ai/cli@0.81.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.