vibe-prospecting

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @vibeprospecting/vpai package from the NPM registry to enable command-line tools for prospecting.
  • [COMMAND_EXECUTION]: The skill requires the execution of shell commands using the vpai CLI to perform data fetching, enrichment, and authentication tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large volumes of external B2B data (company info, contact roles, tech stacks) which could contain adversarial instructions targeting the agent.
  • Ingestion points: Data returned by the vpai CLI tools and local CSV files generated during the prospecting workflow.
  • Boundary markers: Absent; instructions do not require the use of delimiters or specific warnings to ignore embedded instructions when handling data from the prospecting API.
  • Capability inventory: Shell command execution via vpai, file system read/write access for CSV handling, and browser-based OAuth authentication flows.
  • Sanitization: Absent; no explicit sanitization or validation logic is defined for the content retrieved from the external data providers before it is rendered into markdown or processed further.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:35 PM