vibeward@0.7.0
CAUTION· install onlyPublisher claims: "Stops the insecure prompt before your AI agent runs it — and audits what it already shipped. A deterministic guardrail (no LLM call) for Claude Code, Cursor, Codex, Copilot, Gemini, Windsurf and opencode that catches "disable RLS" or "use the service_role" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher jsiapodev · publishing for 97 daysInstalls 66Last detonated 13 min ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsdist/checks/intent.js:142 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Logging a key's NAME is not a leak, and .env.example is meant to be committedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/scanners/folder.js:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const isEnv = base === '.env' || (base.startsWith('.env') && !ENV_SAFE.test(base));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/vibeward.mjs:760 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"secrets committed to the repo, a checked-in `.env`, migrations creating tables without RLS,",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/init/templates.js:536 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05'- **Never commit `.env`, and never log the value of a secret.** The name is fine, the',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/intent.js:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05{ verb: 'ship', target: () => '\\.env\\b', bidirectional: false },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/vibeward.mjs:853 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"cannot: secrets committed to the repo, a checked-in `.env`, migrations that create tables",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/guard/moments.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const ENV_FILE = /(^|[\\/])\.env(\.[\w-]+)?$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/injection.js:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* fired on ordinary sentences like "Copy .env.example to .env, then start the agent" — a lineFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/guard/moments.js:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* `.env` cannot simply be skipped.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/vibeward.mjs:496 · npx invocation of non-well-known package — may execute untrusted code
AST06return `npx vibeward@${version} guard`;Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsdist/checks/lexicon.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// already language-independent. `RLS`, `service_role`, `CORS`, `.env`, `sb_secret`, `bucket`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/injection.js:177 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// `.env` but never `.env.example` and friends, which exist to be committed. Without theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/init/templates.js:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05'cannot: secrets committed to the repo, a checked-in `.env`, migrations that create tables',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/intent.js:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05instead: 'Read it from a server-side environment variable. Keep secrets out of the repo (git-ignore `.env`) and out of any client bundle.',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/init/templates.js:438 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05'secrets committed to the repo, a checked-in `.env`, migrations creating tables without RLS,',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/vibeward.mjs:1064 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"- **Never commit `.env`, and never log the value of a secret.** The name is fine, the",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/guard/moments.js:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const ENV_SAMPLE = /(^|[\\/])\.env\.(example|sample|template|dist|defaults)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/intent.js:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05risk: 'Committing or exposing the .env file',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/vibeward.mjs:30 · npx invocation of non-well-known package — may execute untrusted code
AST06return `This vibeward is ${age} old (v${VERSION}, released ${RELEASED}). The guard's rules only cover phrasings that existed then \u2014 update with \`npx vibeward@latest init\`.`;Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsdist/guard/moments.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* `.env` is the correct home for a secret, so flagging every key in it would fire on the fixFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/intent.js:147 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05why: 'Committing `.env` (or logging secrets) leaks every credential in it to your repo, your logs, or your users.',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/injection.js:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const EXFIL_TARGET = `(?:${T.secret}|${T.serviceKey}|\\.env\\b)`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/guard/moments.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05/** A real `.env`, where a secret belongs. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/scanners/folder.js:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const ENV_SAFE = /\.env\.(example|sample|template)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/vibeward.mjs:6242 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const isEnv = base === ".env" || base.startsWith(".env") && !ENV_SAFE.test(base);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/vibeward.mjs:6192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05var ENV_SAFE = /\.env\.(example|sample|template)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/scanners/folder.js:127 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05evidence: 'A .env file was found in the project tree',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/checks/lexicon.js:293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05/\b(localhost|docker[-\s]?compose|\.env\.(example|sample|template|dist)|\.gitignore|gitignore)\b/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patterndist/checks/injection.js:140 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06// A bare `curl … | sh` is deliberately not a rule here. It is the documented install commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:464 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01> the AGENTS.md target, add `@AGENTS.md` as the first line of your `CLAUDE.md` — or just install theFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagedist/init/binary.d.ts:60 · npx invocation of non-well-known package — may execute untrusted code
AST06* pinned npx is no longer a decision anybody made — it is the only thing `init` writes. LeftFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/reporters/strings.js:75 · npx invocation of non-well-known package — may execute untrusted code
AST06initHint: 'For the website section, `npx vibeward@latest init` installs a skill that reads these findings, applies the fixes it can, and re-scans to verify.',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/templates.js:269 · npx invocation of non-well-known package — may execute untrusted code
AST06'> npx vibeward@latest init',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/vibeward.mjs:608 · npx invocation of non-well-known package — may execute untrusted code
AST06"> npx vibeward@latest init",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/reporters/strings.js:71 · npx invocation of non-well-known package — may execute untrusted code
AST06…t** inspected: Playwright is not installed. Install it (`npm i -D playwright && npx playwright install chromium`) and re-run to include runtime errors.', nextStepsTitle: …Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/run.js:377 · npx invocation of non-well-known package — may execute untrusted code
AST06log(`${C.dim}the prompt you just typed. Re-run \`npx vibeward@latest init\` to update it.${C.reset}`);Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Prompt injection attemptREADME.md:272 · Prompt injection attempt — 'ignore previous instructions' · informational: not an instruction file
AST01It is a rule engine and not a model, which is the whole point: *"ignore previous instructions"*Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagedist/init/binary.d.ts:53 · npx invocation of non-well-known package — may execute untrusted code
AST06* - `npx vibeward@<older> guard` — a pin this tool wrote itself.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/templates.js:277 · npx invocation of non-well-known package — may execute untrusted code
AST06'npx vibeward@latest init --scope project \\',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.d.ts:52 · npx invocation of non-well-known package — may execute untrusted code
AST06* - `npx vibeward@latest guard` — what versions before the pin used to write.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/templates.js:50 · npx invocation of non-well-known package — may execute untrusted code
AST06'npx vibeward@latest <url> --passive --json --stdout --out vibeward-report.md --yes',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/vibeward.mjs:616 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx vibeward@latest init --scope project \\",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.js:57 · npx invocation of non-well-known package — may execute untrusted code
AST06return `npx vibeward@${version} guard`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/templates.js:58 · npx invocation of non-well-known package — may execute untrusted code
AST06'npx vibeward@latest scan <folder> --json --stdout --out vibeward-code-report.md',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.d.ts:41 · npx invocation of non-well-known package — may execute untrusted code
AST06* actually run. The caller then keeps the npx pin. A hook that points at something broken isFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/run.js:520 · npx invocation of non-well-known package — may execute untrusted code
AST06log(`\n ${C.dim}Try it:${C.reset} ${C.cyan}npx vibeward@latest https://your-site.com --passive --out vibeward-report.md --yes${C.reset}\n`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/run.js:167 · npx invocation of non-well-known package — may execute untrusted code
AST06// `npx vibeward@latest guard`. Noting it here is what tells the user their install isFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/version.d.ts:7 · npx invocation of non-well-known package — may execute untrusted code
AST06* have run `npx vibeward@latest` and always been current, but that trades the guard'sFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/vibeward.mjs:678 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx vibeward@latest --version",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/version.js:42 · npx invocation of non-well-known package — may execute untrusted code
AST06return `This vibeward is ${age} old (v${VERSION}, released ${RELEASED}). The guard's rules only cover phrasings that existed then — update with \`npx vibeward@latest init\`.`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/checks/console.js:69 · npx invocation of non-well-known package — may execute untrusted code
AST06// Package present, browser binaries missing (`npx playwright install`) — extremelyFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.js:3 · npx invocation of non-well-known package — may execute untrusted code
AST06// The hook runs on every prompt the user types, which makes it the one place `npxFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.d.ts:12 · npx invocation of non-well-known package — may execute untrusted code
AST06/** Hook timeout in seconds. A cold npx download needs far longer than a local binary. */Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/templates.d.ts:55 · npx invocation of non-well-known package — may execute untrusted code
AST06* discovery channels (`npx skills add`, the plugin), where somebody who has not installedFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/run.js:383 · npx invocation of non-well-known package — may execute untrusted code
AST06log(`${C.dim}\`npx vibeward@latest init\` to raise the pin — it rewrites the hook in place.${C.reset}`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commanddist/checks/injection.js:288 · Process kill command — agent can terminate processes
AST05// not re-read as an attack. That handed every attacker a kill switch: a page containing theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagedist/init/hooks.js:169 · npx invocation of non-well-known package — may execute untrusted code
AST06`// ${MARK} — regenerate with \`npx vibeward@latest init\``,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/templates.js:339 · npx invocation of non-well-known package — may execute untrusted code
AST06'npx vibeward@latest --version',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/reporters/strings.js:148 · npx invocation of non-well-known package — may execute untrusted code
AST06…nspeccionaron: Playwright no está instalado. Instálalo (`npm i -D playwright && npx playwright install chromium`) y vuelve a ejecutar para incluir los errores en tiempo de ej…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.js:109 · npx invocation of non-well-known package — may execute untrusted code
AST06* actually run. The caller then keeps the npx pin. A hook that points at something broken isFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/core/version.js:8 · npx invocation of non-well-known package — may execute untrusted code
AST06* have run `npx vibeward@latest` and always been current, but that trades the guard'sFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/reporters/strings.js:152 · npx invocation of non-well-known package — may execute untrusted code
AST06initHint: 'Para la sección del sitio web, `npx vibeward@latest init` instala una skill que lee estos hallazgos, aplica los arreglos que puede y vuelve a escanear para verificarlo.',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/init/binary.js:20 · npx invocation of non-well-known package — may execute untrusted code
AST06* The npx cache directory. A `vibeward` found in there belongs to the `npx vibeward@latestFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shelldist/checks/injection.js:140 · Remote installer piped to shell
AST07// A bare `curl … | sh` is deliberately not a rule here. It is the documented install commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagedist/init/templates.d.ts:70 · npx invocation of non-well-known package — may execute untrusted code
AST06…/ export declare const GH_WORKFLOW = "# vibeward v0.7.0 \u2014 regenerate with `npx vibeward@latest init`\nname: vibeward\n\non: [push, pull_request]\n\npermissions:\n security-e…Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈88 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Not checked against OSV yet; the weekly check has not reached this version.
What would make this Verified
8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim jsiapodev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jsiapodevPropose a patch to the maintainer