registry / @vatio-ai/skills / 2.2.0
@vatio-ai/skills@2.2.0
Vatio skills and MCP for Claude Code, Cursor and Codex: build and test an AI agent for the app you're building with /vatio-init, improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze. Vatio holds the agent; no config files
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package's writes are part of its documented, user-invoked setup flow and target the project configuration and skill directories. Its install telemetry is disclosed, limited to install/session and coding-agent details, and can be disabled.
Static reason
No blocking static signals were detected.
Trigger
A user runs the vatio-skills CLI.
Impact
The reviewed behavior matches the package's stated setup purpose; no malicious behavior was found.
Mechanism
It copies the package's skills, adds the Vatio MCP URL to project configuration, and sends an install event to Vatio unless telemetry is disabled.
AI rationale
The package's writes are part of its documented, user-invoked setup flow and target the project configuration and skill directories. Its install telemetry is disclosed, limited to install/session and coding-agent details, and can be disabled.
Evidence
.agents/skills/<skill>/.claude/skills/<skill>/.mcp.json.cursor/mcp.json~/.vatio/sessions.json
Network endpoints2
vatio.ai/api/developer/v1/cli/eventsvatio.ai/mcp
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes bin/install.mjs as a user-run CLI; package.json declares no lifecycle scripts.
- The CLI documents copying its skills into the selected project and adding the Vatio MCP endpoint to project config.
- The installer copies skills shipped with this package and adds an MCP entry while preserving existing config.
- Install telemetry is disclosed in the CLI and README, and can be disabled with VATIO_TELEMETRY=0 or DO_NOT_TRACK=1.
- The install event goes to Vatio and reports the install command, package version, session ID, and detected coding agent.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flaggedbin/install.mjsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { spawnsync } from "node:child_process";
import { randomuuid } from "node:crypto"
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/install.mjsView on unpkg•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { spawnsync } from "node:child_process";
import { randomuuid } from "node:crypto";
import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs";
import { homedir, platform } from "node:os";
import { basename, dirname, join, relative, resolve } from "node:path";
import { fileurltopath } from "node:url";
const usage = `usage: npx @vatio-ai/skills [--dir path] [--no-mcp]
copies the vatio skills (vatio-init, vatio-improve, vatio-analyze,
vatio-share-session) into path/.agents/skills and path/.claude/skills,
and adds the vatio mcp (https://vatio.ai/mcp) to path/.mcp.json and,
when there is a path/.cursor, path/.cursor/mcp.json. --
Findings
2 High2 Medium7 Low
HighExternal Ai Agent Control Surface Mutationbin/install.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.mjs
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
LowAi Review Evidencebin/install.mjs
Affected versions and remediation
This report applies to @vatio-ai/skills@2.2.0.
See all versions of @vatio-ai/skills for other recorded verdicts.
- Review the evidence and your use of @vatio-ai/skills@2.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.