vibe-coding-guardian
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates version control operations using Git. It instructs the agent to silently run
git initon new projects and perform commits after successful verifications to create a restoration safety net for the user. - [EXTERNAL_DOWNLOADS]: The metadata file contains a command to download the skill definition via
curlfrom the author's official GitHub repository (kanyun-inc/reskill). - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted data, such as external error messages and codebase contents, and possesses capabilities like file writing and command execution. The instructions currently lack specific boundary markers (e.g., delimiters) or sanitization protocols for this ingested data.
- [SAFE]: The skill includes defensive features such as a 'Health Check' that specifically scans for security risks like hardcoded API keys and credentials in the source code.
- [SAFE]: Implements logical constraints to prevent the AI from entering 'debug death spirals' by requiring sequential feature implementation and enforcing a circuit-breaker logic when fixes repeatedly fail.
Audit Metadata