vibe-coding-local-runner

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill provides instructions for starting the PostgreSQL service using elevated permissions on Linux systems via the sudo service postgresql start command.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process content from untrusted project files to determine the execution environment.
  • Ingestion points: package.json, requirements.txt, and TECH_STACK.md (specified in the Entry Router section).
  • Boundary markers: Absent; the agent is directed to read these files directly to determine its next set of instructions.
  • Capability inventory: The skill facilitates extensive shell command execution across various runtimes (Node.js, Python, Go, Rust, Ruby, PHP), database management, and process termination (kill -9).
  • Sanitization: No sanitization or validation of the input file content is defined before the agent performs routing based on the detected framework.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of external development utilities from public repositories, such as air for Go (github.com/cosmtrek/air) and cargo-watch for Rust, using their respective package managers.
  • [COMMAND_EXECUTION]: The skill facilitates a wide range of terminal commands for local development, including dependency installation (npm install, pip install), environment setup (cp .env.example .env.local), and process management (kill -9 [PID], taskkill /PID [PID] /F).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:29 AM