vibe-code-research
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes a robust 'Secret Redaction' policy that mandates the masking of sensitive data such as private keys, JWTs, API tokens, and environment secrets (e.g., [REDACTED:apikey]) before any information is output to the user or saved to disk.
- [COMMAND_EXECUTION]: The instructions establish a strict read-only boundary. The agent is explicitly forbidden from running state-mutating commands like
sed -i,rm, orgit checkout, and must report any attempted writes as boundary violations. - [INDIRECT_PROMPT_INJECTION]: To mitigate risks from untrusted code, the skill enforces a 'bound corpus' strategy. It restricts investigation to verified workspaces and requires the agent to label and treat external or unverified findings as 'Unproven' unless corroborated by primary sources.
Audit Metadata