vibe-coding
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input ("Vibe" requests) to generate technical design primitives, creating an attack surface for potential influence via data ingestion. However, the skill provides comprehensive guidance on mitigating these risks.
- Ingestion points: SKILL.md Step 1 (Vibe Analysis) receives the 'User Request' as untrusted input.
- Boundary markers: The skill does not define specific delimiters for input but includes a detailed 'Security & Guardrails' section for the agent to follow.
- Capability inventory: The skill proposes changes to CSS, typography, motion effects, and design tokens.
- Sanitization: The instructions explicitly advise on technical mitigations, including regex validation for hex codes and performing visual heuristic scans.
- [NO_CODE]: The skill consists entirely of markdown instructions and metadata, containing no executable scripts, binaries, or automated installation processes.
Audit Metadata