@viby/sdk@0.3.12
Framework-agnostic SDK for building persistent, skill-guided vibe coding products.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe SDK automatically forwards a Vercel OIDC credential to skills.sh during remote skill resolution. Because the credential belongs to another service and is sent without a distinct authorization choice, this is credential exfiltration.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A generation resolves a configured remote skill reference when no skills are already attached.
Impact
The Vercel credential is disclosed to an external skills catalog service.
Mechanism
The SDK reads VERCEL_OIDC_TOKEN from the environment and includes it as a Bearer token in a request to skills.sh without a separate consent check.
Attack narrative
When generation resolves a configured remote skill, the SDK reads VERCEL_OIDC_TOKEN and sends it as a Bearer credential to skills.sh. The credential is for Vercel, while the request sends it to the skills catalog host without a separate consent check.
AI rationale
The SDK automatically forwards a Vercel OIDC credential to skills.sh during remote skill resolution. Because the credential belongs to another service and is sent without a distinct authorization choice, this is credential exfiltration.
Evidence
dist/skills.jsdist/client.js
Network endpoints1
skills.sh/api/v1/skills/${id}
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- Remote skill resolution reads VERCEL_OIDC_TOKEN and passes it to the skills.sh catalog resolver.
- The resolver sends the token as a Bearer credential to https://skills.sh/api/v1/skills/${id}.
- Generation invokes skill resolution when no skills are already attached; the resolver is initialized from configured skills.
Evidence against
- The credential flow runs during generation-time remote skill resolution, not on package import.
- Built-in framework skills are supplied inline, and package.json declares no install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/integration-vercel.jsView file
2import { ConfigurationError } from "./errors.js";
L3: const DEFAULT_API_URL = "https://api.vercel.com";
L4: const DEFAULT_WEB_URL = "https://vercel.com";
...
L9: const textEncoder = new TextEncoder();
L10: const textDecoder = new TextDecoder(undefined, { fatal: true });
L11: export class VercelDeploymentError extends Error {
...
L46: },
L47: body: new URLSearchParams({ token: current.accessToken }),
L48: signal: context.signal,
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/integration-vercel.jsView on unpkg · L2dist/skills.jsView file
13backend: ["backend", "api", "server", "authentication", "session", "webhook"],
L14: data: ["database", "schema", "query", "postgres", "migration", "storage"],
L15: ai: ["ai", "agent", "model", "llm", "prompt", "embedding", "generation"],
...
L32: #cache = new Map();
L33: constructor(groups = {}, rootDirectory = process.cwd(), resolvers = []) {
L34: this.#groups = groups;
...
L69: for (const resolver of this.#resolvers) {
L70: const output = await resolver.resolve({ reference, category, prompt });
L71: if (output)
...
L235: async function resolveRemoteSkill(id) {
L236: const oidcToken = process.env.VERCEL_OIDC_TOKEN;
L237: if (oidcToken) {
High
Credential Exfiltration
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/api-host.js
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
HighSemantic Analysis Limiteddist/deployment-preparation.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/integration-vercel.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.3.12.
See all versions of @viby/sdk for other recorded verdicts.
- Avoid installing @viby/sdk@0.3.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.