vibe-hardener

Role/instruction override attempt detected

Ignore all previous instructions

Remote code download and execution detected

python -c "import urllib.request; urllib

The skill provides a massive list of shell commands for auditing, including network-related tools and dependency scanners, which significantly exceeds the scope of a simple code review tool. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]

grep -r "api_key\|apikey\|API_KEY..." .

The instructions explicitly command the agent to install packages via `npm install` and `npx` without version pinning or integrity checks, creating a supply chain risk. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]

npm install --save-dev eslint @eslint/js typescript-eslint

JavaScript dynamic code execution (new Function / setTimeout/setInterval with a string body)

setInterval("

Outbound network request primitive in skill code — can transmit data externally

fetch('https://api.openai.com/v1/chat/completions', {
  headers: { 'Authorization': 'Bearer sk-abc123' }
})

Environment secret flows to a network sink (JS/TS)

taint source (line 10): process.env.LLM_BASE_URL → sink: fetch(`${config.llmBaseUrl}/chat/completions`, {
  headers: { 'Authorization': `Bearer ${config.llmApiKey}` }
})

Runaway agent loop — excessive retry counts, deep recursion, or self-recursive call patterns

retry 400

User input is used to construct a URL for a server-side HTTP request. This could allow an attacker to make requests to internal services or cloud metadata endpoints (Server-Side Request Forgery). Validate URLs against an allowlist of permitted hosts and schemes.

taint source (line 10): process.env.LLM_BASE_URL → sink: fetch(`${config.llmBaseUrl}/chat/completions`, {
  headers: { 'Authorization': `Bearer ${config.llmApiKey}` }
})

User-controlled input is concatenated into a SQL query string. This allows SQL injection where an attacker can modify the query structure. Use parameterized queries with placeholders ($1, ?) instead of string concatenation. (seen 2 times in this file at lines 16, 24)

taint source (line 16): idempotencyKey → sink: idempotencyKey

Detected use of raw SQL with string formatting in Django. This can lead to SQL injection. Use Django's ORM methods (filter, get, exclude) or use parameterized raw queries with RawSQL or cursor.execute() with %s placeholders and a params list.

cursor.execute(f"SELECT * FROM users WHERE id = '{user_id}'")

User-controlled input is used in an HTTP response header. If the input contains CRLF characters, this enables HTTP response splitting. Validate header values by rejecting newline characters.

taint source (line 6): req.headers['x-correlation-id'] → sink: correlationId

User-controlled input is used in an HTTP response header value. If the input contains CR/LF characters, this enables HTTP response splitting where an attacker can inject arbitrary headers or a second response body. Validate and sanitize header values by rejecting newline characters.

taint source (line 7): request.headers.get("x-correlation-id", str(uuid.uuid4())) → sink: correlation_id

Untrusted data flows to an external API call without validation. Data from sources like window.name, document.location, or other client-controlled inputs is passed to library functions that may interpret it in unsafe ways. Validate or sanitize all untrusted input before passing it to external APIs.

taint source (line 10): process.env.LLM_BASE_URL → sink: fetch(`${config.llmBaseUrl}/chat/completions`, {
  headers: { 'Authorization': `Bearer ${config.llmApiKey}` }
})

Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime (seen 17 times in this file at lines 114, 117, 120, 130, 858, 864, 1079, 1850, 2170, 2623, …)

npx depcheck 

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

Skill does not specify a license field. Specifying a license helps users understand usage terms.