vibe-kanban
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill logic and instructional content are consistent with its purpose as a coding board control plane.
- [COMMAND_EXECUTION]: Automated Bash scripts handle project lifecycle tasks including workspace cleanup and service health checks. The setup script (scripts/mcp-setup.sh) configures local agent environments by modifying Claude and Codex configuration files with appropriate validation and error handling.
- [EXTERNAL_DOWNLOADS]: The skill fetches the vibe-kanban package via npx and utilizes a Docker image for deployment, both originating from the official project repository.
- [PROMPT_INJECTION]: The skill processes user-provided task descriptions through the vk_create_card tool (references/mcp-api.md). The potential for indirect prompt injection is mitigated by the skill's core design requiring manual human review of all code diffs and the use of isolated Git worktrees (SKILL.md).
Audit Metadata