registry / @vatio-ai/skills / 1.29.1
@vatio-ai/skills@1.29.1
Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package exposes an explicitly run CLI that copies its own skills into expected project directories and limits retired-skill removal to copies it recognizes as its own. Its install telemetry is disclosed, can be disabled, and reports package and agent/session metadata to Vatio’s service.
Static reason
No blocking static signals were detected.
Trigger
Running the vatio-skills CLI.
Impact
No harmful impact identified; the report contains install metadata and an agent/session identifier.
Mechanism
Copies the included skills into the selected project and reports an install event to the configured Vatio base URL.
AI rationale
The package exposes an explicitly run CLI that copies its own skills into expected project directories and limits retired-skill removal to copies it recognizes as its own. Its install telemetry is disclosed, can be disabled, and reports package and agent/session metadata to Vatio’s service.
Evidence
.agents/skills/.claude/skills/~/.vatio/sessions.json
Network endpoints1
vatio.ai/api/developer/v1/cli/events
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes bin/install.mjs as a CLI, with no lifecycle hook shown.
- The CLI copies the package’s skills into the project’s .agents/skills and .claude/skills directories.
- It removes a retired skill only when its contents identify it as one installed by this package.
- The CLI discloses its install report and provides VATIO_TELEMETRY and DO_NOT_TRACK opt-outs.
- The report sends an install event with package version, coding-agent type, and a session ID; the default endpoint is Vatio’s service.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
8 flaggedbin/install.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { randomuuid } from "node:crypto";
import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, relative, resolve } from "node:path";
import { fileurltopath } from "node:url";
const usage = `usage: npx @vatio-ai/skills [--dir path]
copi
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/install.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
import { randomuuid } from "node:crypto";
import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, relative, resolve } from "node:path";
import { fileurltopath } from "node:url";
const usage = `usage: npx @vatio-ai/ski
Findings
2 High2 Medium8 Low
HighExternal Ai Agent Control Surface Mutationbin/install.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
Affected versions and remediation
This report applies to @vatio-ai/skills@1.29.1.
See all versions of @vatio-ai/skills for other recorded verdicts.
- Review the evidence and your use of @vatio-ai/skills@1.29.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.