@viby/sdk@0.2.5
⚠ Under reviewFramework-agnostic SDK for building persistent, skill-guided vibe coding products.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/client.jsView file
227}
L228: async import(input) {
L229: if (!input || !input.source) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client.jsView on unpkg · L227dist/skills.jsView file
11backend: ["backend", "api", "server", "authentication", "session", "webhook"],
L12: data: ["database", "schema", "query", "postgres", "migration", "storage"],
L13: ai: ["ai", "agent", "model", "llm", "prompt", "embedding", "generation"],
...
L29: #cache = new Map();
L30: constructor(groups = {}, rootDirectory = process.cwd()) {
L31: this.#groups = groups;
...
L139: async function resolveRemoteSkill(id) {
L140: const oidcToken = process.env.VERCEL_OIDC_TOKEN;
L141: if (oidcToken) {
...
L148: async function resolveFromSkillsSh(id, token) {
L149: const response = await fetch(`https://skills.sh/api/v1/skills/${id}`, {
L150: headers: { Authorization: `Bearer ${token}` },
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
dist/skills.jsView on unpkg · L11Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/outbound-events.js
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
MediumDynamic Requiredist/client.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.2.5.
See all versions of @viby/sdk for other recorded verdicts.
- Review the evidence and your use of @viby/sdk@0.2.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.