talent-mapping
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the Vibe Prospecting CLI tool, which is fetched from the npm registry using
npx @vibeprospecting/vpai@latest. This is a vendor-owned package from a well-known registry. - [REMOTE_CODE_EXECUTION]: The setup instructions include executing the vendor's CLI tool (
npx @vibeprospecting/vpai@latest). This pattern involves downloading and running code from a remote source at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large amounts of external B2B data (profiles, company signals, headlines) from Explorium's Vibe Prospecting platform.
- Ingestion points: Data is pulled via the
fetch-entitiesormatch-businesstools, or thevpaiCLI. - Boundary markers: The skill does not define specific delimiters to separate the retrieved data from the instructions.
- Capability inventory: The agent has the ability to execute CLI commands and interact with external data APIs.
- Sanitization: There is no explicit sanitization step described for the content returned by the external APIs.
Audit Metadata