abm-diy-campaign
Warn
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads and executes the Vibe Prospecting CLI tool using
npx @vibeprospecting/vpai@latestduring runtime. - [COMMAND_EXECUTION]: Provides instructions to install and execute the Playwright browser automation library (
npm install -g playwright) and its associated browser binaries. - [CREDENTIALS_UNSAFE]: Directs the user and agent to manage sensitive API keys for LinkedIn, Vibe Prospecting, and Figma, and recommends persisting them in environment variables or shell profile files like
~/.bashrcand~/.zshrc. - [DATA_EXFILTRATION]: Includes code to read local configuration data from the path
~/.config/vpai/config.json. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Data fetched from the Vibe Prospecting API (such as company names or domains) is interpolated into HTML ad templates in
references/04-personalize-figma.mdusing simple string replacement without sanitization. This data is then rendered in a headless browser context (Playwright), creating a risk of HTML/script injection if the source data is compromised or malicious.
Audit Metadata