registry / Credential exfiltration / @vatio-ai/skills
@vatio-ai/skills
Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.
This report shows the evidence for @vatio-ai/skills@1.27.0. 1 of 41 known versions is blocked or flagged. The newest version, 2.2.0, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe vatio-init skill explicitly instructs an agent to send a named environment or .env secret to Vatio without asking the user. This is credential exfiltration without consent, even though the transfer is tied to configuring a Vatio agent.
Static reason
No blocking static signals were detected.
Trigger
A user asks an AI agent to create or set up a Vatio agent, and a required named secret is available in the shell environment or project .env file.
Impact
A credential in the environment or .env file can be disclosed to the package vendor without the user's explicit consent.
Mechanism
The skill instructs the agent to run `vatio secrets set KEY --from-env`, which reads the value and sends it to the Vatio service without asking the user.
Attack narrative
When a user asks an AI agent to create a Vatio agent, the vatio-init skill tells it to run `vatio secrets set KEY --from-env` for a named secret. The command reads the value from the shell or the project's .env file and sends it without asking the user. The README identifies vatio.ai as the CLI's service. This creates a credential disclosure path to the package vendor without explicit consent.
AI rationale
The vatio-init skill explicitly instructs an agent to send a named environment or .env secret to Vatio without asking the user. This is credential exfiltration without consent, even though the transfer is tied to configuring a Vatio agent.
Evidence
skills/vatio-init/SKILL.mdREADME.md.env
Network endpoints1
vatio.ai
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The vatio-init skill is triggered when a user asks to create or set up a Vatio agent.
- The skill directs the agent to read a KEY value from the shell environment or project .env file and send it to Vatio without asking the user.
- The README identifies vatio.ai as the service the CLI talks to.
Evidence against
- The package installer has no lifecycle scripts; it copies the package's skills when the user runs its CLI.
- The skill limits the operation to a named secret and says not to print or copy the value into a file.
Behavioral surface
Filesystem
UrlStrings
Source & flagged code
5 flaggedbin/install.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { cpsync, existssync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs";
import { dirname, join, relative } from "node:path";
import { fileurltopath } from "node:url";
const usage = `usage: npx @vatio-ai/skills [--dir path]
copies the vatio skills (vatio-init, vatio-improve, vatio-analyze,
vatio-share-session) into path/.ag
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/install.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
import { cpsync, existssync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs";
import { dirname, join, relative } from "node:path";
import { fileurltopath } from "node:url";
const usage = `usage: npx @vatio-ai/skills [--dir path]
copies the vatio skills (vatio-init, vatio-improve, vatio-analyze,
vatio-share-
Findings
5 High2 Low
HighExternal Ai Agent Control Surface Mutationbin/install.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.mjs
HighAi Review Evidenceskills/vatio-init/SKILL.md
HighAi Review Evidenceskills/vatio-init/SKILL.md
HighAi Review EvidenceREADME.md
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @vatio-ai/skills@1.27.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @vatio-ai/skills@1.27.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.