@viby/sdk@0.3.10
Framework-agnostic SDK for building persistent, skill-guided vibe coding products.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically forwards VERCEL_OIDC_TOKEN to skills.sh as part of remote skill resolution. Because this is a credential issued for another service and the source shows no consent for the transfer, this is credential exfiltration.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A generation resolves configured string skill references while VERCEL_OIDC_TOKEN is set.
Impact
The external skills.sh service receives a Vercel bearer token that may grant access within its configured scope.
Mechanism
dist/skills.js reads the environment token and places it in the Authorization header of a request to skills.sh.
Attack narrative
When a generation resolves a configured remote skill, the package reads VERCEL_OIDC_TOKEN and sends it as a Bearer token to skills.sh. This exposes a credential issued for Vercel to an unrelated service without an explicit consent step for that credential transfer.
AI rationale
The package automatically forwards VERCEL_OIDC_TOKEN to skills.sh as part of remote skill resolution. Because this is a credential issued for another service and the source shows no consent for the transfer, this is credential exfiltration.
Evidence
dist/skills.jsdist/client.js
Network endpoints1
skills.sh/api/v1/skills/${id}
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/skills.js reads the VERCEL_OIDC_TOKEN environment variable during remote skill resolution.
- The resolver sends that token as a Bearer credential to https://skills.sh/api/v1/skills/${id}.
- Configured string skill references reach the remote resolver.
- Generation startup resolves configured skills when no saved skills are present.
Evidence against
- The credential flow runs during skill resolution, not merely on package import.
- The request is part of the package's remote skills feature, but the source does not show consent to send a Vercel token to skills.sh.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/integration-vercel.jsView file
2import { ConfigurationError } from "./errors.js";
L3: const DEFAULT_API_URL = "https://api.vercel.com";
L4: const DEFAULT_WEB_URL = "https://vercel.com";
...
L9: const textEncoder = new TextEncoder();
L10: const textDecoder = new TextDecoder(undefined, { fatal: true });
L11: export class VercelDeploymentError extends Error {
...
L46: },
L47: body: new URLSearchParams({ token: current.accessToken }),
L48: signal: context.signal,
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/integration-vercel.jsView on unpkg · L2dist/skills.jsView file
13backend: ["backend", "api", "server", "authentication", "session", "webhook"],
L14: data: ["database", "schema", "query", "postgres", "migration", "storage"],
L15: ai: ["ai", "agent", "model", "llm", "prompt", "embedding", "generation"],
...
L32: #cache = new Map();
L33: constructor(groups = {}, rootDirectory = process.cwd(), resolvers = []) {
L34: this.#groups = groups;
...
L69: for (const resolver of this.#resolvers) {
L70: const output = await resolver.resolve({ reference, category, prompt });
L71: if (output)
...
L235: async function resolveRemoteSkill(id) {
L236: const oidcToken = process.env.VERCEL_OIDC_TOKEN;
L237: if (oidcToken) {
High
Credential Exfiltration
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/api-host.js
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
HighSemantic Analysis Limiteddist/deployment-preparation.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/integration-vercel.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.3.10.
See all versions of @viby/sdk for other recorded verdicts.
- Avoid installing @viby/sdk@0.3.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.