vibe-coding-local-runner
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill provides instructions for starting the PostgreSQL service using elevated permissions on Linux systems via the
sudo service postgresql startcommand. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process content from untrusted project files to determine the execution environment.
- Ingestion points:
package.json,requirements.txt, andTECH_STACK.md(specified in the Entry Router section). - Boundary markers: Absent; the agent is directed to read these files directly to determine its next set of instructions.
- Capability inventory: The skill facilitates extensive shell command execution across various runtimes (Node.js, Python, Go, Rust, Ruby, PHP), database management, and process termination (
kill -9). - Sanitization: No sanitization or validation of the input file content is defined before the agent performs routing based on the detected framework.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of external development utilities from public repositories, such as
airfor Go (github.com/cosmtrek/air) andcargo-watchfor Rust, using their respective package managers. - [COMMAND_EXECUTION]: The skill facilitates a wide range of terminal commands for local development, including dependency installation (
npm install,pip install), environment setup (cp .env.example .env.local), and process management (kill -9 [PID],taskkill /PID [PID] /F).
Audit Metadata