vibe-coding-deploy-digitalocean
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute a Node.js setup script using
curl -fsSL https://deb.nodesource.com/setup_20.x | bash. NodeSource is a well-known and widely used service for Node.js distributions.\n- [EXTERNAL_DOWNLOADS]: Fetches configuration and installation scripts from NodeSource's official domain.\n- [COMMAND_EXECUTION]: Utilizes several system-level commands including package management (apt), process management (pm2), and the official DigitalOcean CLI (doctl) to perform deployment tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where untrusted user-provided data, such as repository URLs and application names, are interpolated into shell commands and configuration files.\n - Ingestion points: User-supplied repository strings and application names in the deployment walkthrough in
SKILL.md.\n - Boundary markers: None present to delimit or instruct the agent to ignore instructions within the user-provided strings.\n
- Capability inventory: The skill has access to shell execution via
doctl,ssh, and system package managers.\n - Sanitization: No explicit validation or escaping is described for the user-provided placeholders.
Recommendations
- HIGH: Downloads and executes remote code from: https://deb.nodesource.com/setup_20.x - DO NOT USE without thorough review
Audit Metadata