optimize-protocol

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from analytical reports that could potentially contain instructions intended to influence the agent's code generation logic.
  • Ingestion points: Files such as report_card.json, run_metrics.json, and optimization-*.md are read from ~/.vibehq/analytics/ to determine necessary code changes.
  • Capability inventory: The skill has the ability to modify source code in src/ and bin/, and execute shell commands for building the project.
  • Boundary markers: The instructions do not specify any delimiters or warnings to treat the content of the analytics files as non-executable data.
  • Sanitization: No sanitization process is described for the fix_actions or improvement_suggestions found in the ingested reports.
  • [COMMAND_EXECUTION]: The skill uses local shell commands to facilitate the development lifecycle.
  • It executes npx tsup to compile the TypeScript project.
  • It leverages project-specific CLI tools like vibehq-analyze and vibehq start for data collection and testing.
  • [DYNAMIC_EXECUTION]: The skill is designed to perform autonomous engineering by writing and refactoring TypeScript files in the src/ directory, which are then compiled into executable code. This dynamic code modification is the primary function of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 10:37 AM