@viby/sdk@0.3.13
Framework-agnostic SDK for building persistent, skill-guided vibe coding products.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe SDK forwards a Vercel OIDC credential to skills.sh without an explicit consent step or audience check. This is credential exfiltration to a service outside the credential’s own boundary, although it is triggered by remote skill resolution rather than package import.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The application resolves a remote skill reference while `VERCEL_OIDC_TOKEN` is set.
Impact
The external service receives a credential issued for the Vercel environment, outside its own service boundary.
Mechanism
The resolver reads the environment token and sends it in an Authorization Bearer header to skills.sh.
Attack narrative
When remote skill resolution runs in an environment with `VERCEL_OIDC_TOKEN`, the SDK sends that token as a Bearer credential to skills.sh. The credential is issued for the Vercel environment and is forwarded to a separate service as part of resolving a skill.
AI rationale
The SDK forwards a Vercel OIDC credential to skills.sh without an explicit consent step or audience check. This is credential exfiltration to a service outside the credential’s own boundary, although it is triggered by remote skill resolution rather than package import.
Evidence
dist/skills.jsdist/node-skills.jsdist/index.js
Network endpoints1
skills.sh
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Remote skill resolution reads `VERCEL_OIDC_TOKEN` from the process environment.
- The resolver sends that token as a Bearer credential to `https://skills.sh/api/v1/skills/${id}`, a separate service.
- The forwarding is reachable through the package’s skill resolution path when a remote skill reference is resolved.
Evidence against
- The credential forwarding occurs during remote skill resolution, not at import time.
- The package’s `prepublishOnly` script is a release check and is not an install hook.
- The GitHub token path sends its credential to `api.github.com`, its own service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/integration-vercel.jsView file
2import { ConfigurationError } from "./errors.js";
L3: const DEFAULT_API_URL = "https://api.vercel.com";
L4: const DEFAULT_WEB_URL = "https://vercel.com";
...
L9: const textEncoder = new TextEncoder();
L10: const textDecoder = new TextDecoder(undefined, { fatal: true });
L11: export class VercelDeploymentError extends Error {
...
L46: },
L47: body: new URLSearchParams({ token: current.accessToken }),
L48: signal: context.signal,
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/integration-vercel.jsView on unpkg · L2dist/skills.jsView file
13backend: ["backend", "api", "server", "authentication", "session", "webhook"],
L14: data: ["database", "schema", "query", "postgres", "migration", "storage"],
L15: ai: ["ai", "agent", "model", "llm", "prompt", "embedding", "generation"],
...
L32: #cache = new Map();
L33: constructor(groups = {}, rootDirectory = process.cwd(), resolvers = []) {
L34: this.#groups = groups;
...
L69: for (const resolver of this.#resolvers) {
L70: const output = await resolver.resolve({ reference, category, prompt });
L71: if (output)
...
L235: async function resolveRemoteSkill(id) {
L236: const oidcToken = process.env.VERCEL_OIDC_TOKEN;
L237: if (oidcToken) {
High
Credential Exfiltration
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/api-host.js
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
HighSemantic Analysis Limiteddist/deployment-preparation.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/integration-vercel.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.3.13.
See all versions of @viby/sdk for other recorded verdicts.
- Avoid installing @viby/sdk@0.3.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.