Aguara Watch

vercel-ai-sdk

skills-sh:fluid-tools_claude-skills__vercel-ai-sdk

View source
A
100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

3

Score

100/100

LOW 3

Findings (3)

LOW
Unscoped Bash tool in allowed tools
L4

Detects skills that include unscoped Bash in their allowed tools list (not Bash(cmd:*) scoped)

allowed-tools:
  - Read
  - Write
  - Edit
  - Glob
  - Grep
  - Bash
FIX

Scope the Bash tool to specific commands using allowedTools patterns (e.g., Bash(git *) instead of bare Bash). Remove blanket Bash access from allowed_tools lists.

FP?

Likely FP if the Bash entry in allowed_tools is part of a constrained configuration that limits commands elsewhere (e.g., via system prompt restrictions).

LOW
Runtime URL controlling behavior
L49

Detects URLs fetched at runtime that control or influence agent behavior without pinning

Fetch to check https:// + Schema
FIX

Avoid loading configuration or behavior-controlling content from runtime URLs. Bundle required configurations locally or pin remote config to versioned, integrity-verified endpoints.

FP?

Likely FP if the URL in the match is a documentation link or example URL (e.g., example.com) rather than an actual runtime-fetched configuration endpoint.

LOW
Auto-confirm flag bypassing user verification
L1080

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.