@vatio-ai/cli@0.86.0
Vatio CLI — deploy and manage Vatio agent workspaces
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe explicit sharing gate and configurable API destination make this a conditional credential-forwarding risk rather than evidence of covert theft. Warn because the bearer token is not bound to the configured recipient.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An operator invokes `vatio share-session` and confirms sending, or uses `--yes`.
Impact
A token may be disclosed to an unintended configured endpoint when sharing is confirmed. The source does not establish that any such disclosure occurred.
Mechanism
The request uses `config.resolveBaseUrl()` for its destination and `config.resolveToken()` for its bearer authorization; the base URL accepts environment or saved configuration overrides.
AI rationale
The explicit sharing gate and configurable API destination make this a conditional credential-forwarding risk rather than evidence of covert theft. Warn because the bearer token is not bound to the configured recipient.
Evidence
lib/commands/support-commands.mjslib/config.mjs
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI dispatches transcript sharing only for an explicit `share-session` command; trial retry and error-reporting paths are separate from that caller.
- Transcript sharing sends the saved Vatio bearer token to a URL resolved from configuration, with no destination check in the send path.
- The base URL can come from `VATIO_BASE_URL` or saved configuration, while token resolution is independent of the URL.
- Sharing requires `--yes` or an affirmative interactive response; without `--yes`, noninteractive use stops without sending.
- The agent-related paths inspected write workspace guidance from `init` and inspect installed skill markers; they do not establish an agent-control attack.
- The manifest exposes the `vatio` CLI entrypoint.
Evidence against
- Transcript sharing is user-invoked and gated by an affirmative prompt or `--yes`, limiting exposure to that operation.
- The configured base URL may be intentionally selected for a Vatio-compatible deployment; source does not establish a fixed unrelated recipient.
Behavioral surface
Source & flagged code
6 flaggedlib/skills-hint.mjsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, resolve } from "node:path";
import { confighome } from "./config.mjs";
import { paint } from "./support.mjs";
const skill = "vatio-improve";
const version_file = ".vatio-sk[redacted]";
const latest_url = "https://registry.npmjs.org/@vatio-ai/skills/latest";
const show_every_ms = 24 * 60 * 60 * 1000;
const check_every_ms = 24 * 60 * 60 * 1000;
const fetch_timeout_ms = 1_500;
export async function printskillshint(startdir = process.cwd()) {
if (process.env.ci || process.env.vatio_no_skills_hint) return;
const path = join(confighome(), "sk
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/skills-hint.mjsView on unpkg77".claude");
const found = [];
const plugin = pluginVersion(join(claudeHome, "plugins", "installed_plugins.json"));
if (plugin !== undefined) found.push({ kind: "plugin", vers
Medium
Ai Review Evidence
The agent-related paths inspected write workspace guidance from `init` and inspect installed skill markers; they do not establish an agent-control attack.
lib/skills-hint.mjsView on unpkg · L77Findings
3 High5 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/skills-hint.mjs
HighSemantic Analysis Limitedbin/vatio.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/support.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencelib/commands/misc.mjs
MediumAi Review Evidencelib/skills-hint.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @vatio-ai/cli@0.86.0.
See all versions of @vatio-ai/cli for other recorded verdicts.
- Review the evidence and your use of @vatio-ai/cli@0.86.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.