@viby/sdk@0.3.18
Framework-agnostic SDK for building persistent, skill-guided vibe coding products.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe remote skill resolver automatically forwards VERCEL_OIDC_TOKEN to skills.sh, a host outside the credential's own service. This is credential exfiltration under the review rules.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A generation resolves a remote skill reference while VERCEL_OIDC_TOKEN is present.
Impact
The skills.sh host receives a credential issued for Vercel, exposing it outside its own service.
Mechanism
The resolver reads the environment token and puts it in the Authorization Bearer header of a request to skills.sh.
Attack narrative
When generation resolves a configured remote skill, the SDK reads VERCEL_OIDC_TOKEN and sends it as a Bearer token to skills.sh. The token belongs to Vercel, and the source shows no consent check or user-configured destination for this transfer.
AI rationale
The remote skill resolver automatically forwards VERCEL_OIDC_TOKEN to skills.sh, a host outside the credential's own service. This is credential exfiltration under the review rules.
Evidence
dist/skills.jsdist/client.js
Network endpoints1
skills.sh/api/v1/skills/${id}
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Remote skill resolution reads VERCEL_OIDC_TOKEN from the process environment.
- The token is sent as a Bearer credential to https://skills.sh/api/v1/skills/${id}.
- Generation startup resolves configured skills for the prompt, reaching this flow when a remote skill reference is used.
Evidence against
- The network request is tied to the SDK's documented remote skill resolution feature.
- This flow requires a remote skill reference; package import alone does not invoke it.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/client.jsView file
634}
L635: async import(input) {
L636: if (!input || !input.source) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client.jsView on unpkg · L634dist/integration-vercel.jsView file
2import { ConfigurationError } from "./errors.js";
L3: const DEFAULT_API_URL = "https://api.vercel.com";
L4: const DEFAULT_WEB_URL = "https://vercel.com";
...
L9: const textEncoder = new TextEncoder();
L10: const textDecoder = new TextDecoder(undefined, { fatal: true });
L11: export class VercelDeploymentError extends Error {
...
L46: },
L47: body: new URLSearchParams({ token: current.accessToken }),
L48: signal: context.signal,
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/integration-vercel.jsView on unpkg · L2dist/skills.jsView file
Findings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/sandbox-cloudflare.d.ts
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
HighSemantic Analysis Limiteddist/deployment-preparation.js#virtual:normalized:round1
MediumDynamic Requiredist/client.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/integration-vercel.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.3.18.
See all versions of @viby/sdk for other recorded verdicts.
- Avoid installing @viby/sdk@0.3.18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.