optimize-protocol
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from analytical reports that could potentially contain instructions intended to influence the agent's code generation logic.
- Ingestion points: Files such as
report_card.json,run_metrics.json, andoptimization-*.mdare read from~/.vibehq/analytics/to determine necessary code changes. - Capability inventory: The skill has the ability to modify source code in
src/andbin/, and execute shell commands for building the project. - Boundary markers: The instructions do not specify any delimiters or warnings to treat the content of the analytics files as non-executable data.
- Sanitization: No sanitization process is described for the
fix_actionsorimprovement_suggestionsfound in the ingested reports. - [COMMAND_EXECUTION]: The skill uses local shell commands to facilitate the development lifecycle.
- It executes
npx tsupto compile the TypeScript project. - It leverages project-specific CLI tools like
vibehq-analyzeandvibehq startfor data collection and testing. - [DYNAMIC_EXECUTION]: The skill is designed to perform autonomous engineering by writing and refactoring TypeScript files in the
src/directory, which are then compiled into executable code. This dynamic code modification is the primary function of the skill.
Audit Metadata