@viby/sdk@0.7.0
Framework-agnostic SDK for building persistent, skill-guided vibe coding products.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package forwards VERCEL_OIDC_TOKEN to skills.sh during remote skill resolution, disclosing a credential to a host other than the service that issued it. The transfer is reachable during generation and is not disclosed in the documented skill configuration.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A generation resolves an uncached configured remote skill while VERCEL_OIDC_TOKEN is present.
Impact
The external skills.sh service receives a credential issued for Vercel, creating an unauthorized credential disclosure.
Mechanism
The resolver reads the environment token and sends it in an Authorization: Bearer header to skills.sh.
Attack narrative
When generation resolves a configured remote skill, the package reads VERCEL_OIDC_TOKEN and sends it as a Bearer token to skills.sh. This transfers a Vercel-issued credential to an external service without a consent check or documented disclosure. The lookup is reachable during generation when no skill snapshot is already saved.
AI rationale
The package forwards VERCEL_OIDC_TOKEN to skills.sh during remote skill resolution, disclosing a credential to a host other than the service that issued it. The transfer is reachable during generation and is not disclosed in the documented skill configuration.
Evidence
dist/skills.jsdist/client.js
Network endpoints1
skills.sh/api/v1/skills/{id}
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Remote skill resolution reads VERCEL_OIDC_TOKEN and passes it to the skills.sh resolver.
- The resolver sends that token as a Bearer credential to https://skills.sh/api/v1/skills/{id}.
- Generation processing invokes skill resolution when it has no saved skill snapshot.
- The package documents skills.sh-compatible remote skill references.
Evidence against
- The credential transfer occurs during generation skill resolution, not from an install hook or module import.
- The remote skill lookup serves the package's documented skill-resolution feature.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/client.jsView file
684}
L685: async import(input) {
L686: if (!input || !input.source) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client.jsView on unpkg · L684dist/integration-netlify.jsView file
3import { ConfigurationError } from "./errors.js";
L4: const DEFAULT_API_URL = "https://api.netlify.com/api/v1";
L5: const DEFAULT_AUTHORIZATION_URL = "https://app.netlify.com/authorize";
...
L14: const textEncoder = new TextEncoder();
L15: const textDecoder = new TextDecoder(undefined, { fatal: true });
L16: export class NetlifyDeploymentError extends Error {
...
L106: const token = await oauthRequest(runtime, {
L107: body: new URLSearchParams({
L108: grant_type: "authorization_code",
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/integration-netlify.jsView on unpkg · L3dist/skills.jsView file
Findings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/api-host.js
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
HighSemantic Analysis Limiteddist/deployment-preparation.js#virtual:normalized:round1
MediumDynamic Requiredist/client.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/integration-netlify.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.7.0.
See all versions of @viby/sdk for other recorded verdicts.
- Avoid installing @viby/sdk@0.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.