vercel-ai-sdk-attack-probe

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document explicitly outlines active attack probes (SSRF to cloud metadata, remote code execution via loose tool schemas, unauthorized endpoint access, tool discovery/exfiltration, and XSS vectors) that enable credential theft, data exfiltration, and remote command execution — i.e., clear abuse patterns.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow for this skill is to probe a Vercel AI SDK chat/completion endpoint (e.g., /api/chat) by sending POST requests and then ingesting the streamed model output back into the agent context; that output can include attacker-supplied free text (the probe payloads) and thus constitutes outsider-authored free text entering the LLM context via the response stream.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The prompt explicitly encourages invoking registered tools that can run arbitrary shell commands (example: execAsync(cmd)), SSRF to instance metadata, and similar probes that can lead to remote command execution or privileged data access, so it materially risks compromising the host even if it doesn't explicitly instruct creating users or editing sudo-protected files.