Vant skill audit security
Skill dhaupin/vant/models/public/skills/vant-skill-audit-security
Vant: Durable AI memory + cold storage + runtime for agents, with generational evolution, stored passively via GitHub. Built for long-running autonomous sessions, using file based persistence.
npx -y skills add dhaupin/vant --skill vant-skill-audit-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Is this safe?
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.1 KB, as published. Nobody here has run it
Security Audit
Is this safe?
When To Run
- Before deploy
- After adding auth/credentials
- New endpoints
- External inputs
What To Check
1. Credentials
# Hardcoded secrets?
grep -rn "sk-\|api_key\|password\|secret" . --include="*.js"
grep -rn "Bearer\|Token" . --include="*.js"
| Check | Issue | Fix |
|---|---|---|
| Hardcoded API key | HIGH | Use env var |
| Password in code | HIGH | Use env |
| Token in logs | MEDIUM | Redact |
2. Inputs
// Never trust user input
req.params.id
req.body.data
query.string
| Check | Issue | Fix |
|---|---|---|
| SQL from input | HIGH | Parameterize |
| Eval input | HIGH | Remove eval |
| Shell from input | HIGH | No shell |
| File from input | HIGH | Validate path |
3. Auth
// Check auth exists
function protected() {
if (!req.user) return error
// Good
}
| Check | Issue | Fix |
|---|---|---|
| No auth check | HIGH | Add auth |
| Auth bypassed | HIGH | Fix |
| Weak auth | MEDIUM | Strengthen |
4. Network
| Check | Issue |
|---|---|
| HTTP not HTTPS | Use HTTPS |
| Credentials in URL | Headers only |
| No CORS | Set CORS |
5. Filesystem
// Check file access
fs.readFile(userPath)
| Check | Issue | Fix |
|---|---|---|
| Path traversal | HIGH | Sanitize |
| Read any file | HIGH | Validate |
| Write anywhere | HIGH | Restrict |
Output
## Security Audit - [file]
### Credentials
- [PASS/FAIL] Hardcoded keys: [details]
### Inputs
- [PASS/FAIL] SQL injection: [details]
### Auth
- [PASS/FAIL] Protected: [details]
### Summary
| Severity | Count |
|----------|-------|
| HIGH | 0 |
| MEDIUM | 0 |
| LOW | 0 |
Severity
| Severity | Meaning |
|---|---|
| HIGH | Exploit - fix now |
| MEDIUM | Risk - fix soon |
| LOW | Note - fix Optional |
Role: Security Auditor
Input: Code to review
Output: Issues found