vibe-prospecting
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@vibeprospecting/vpaipackage from the NPM registry to enable command-line tools for prospecting. - [COMMAND_EXECUTION]: The skill requires the execution of shell commands using the
vpaiCLI to perform data fetching, enrichment, and authentication tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large volumes of external B2B data (company info, contact roles, tech stacks) which could contain adversarial instructions targeting the agent.
- Ingestion points: Data returned by the
vpaiCLI tools and local CSV files generated during the prospecting workflow. - Boundary markers: Absent; instructions do not require the use of delimiters or specific warnings to ignore embedded instructions when handling data from the prospecting API.
- Capability inventory: Shell command execution via
vpai, file system read/write access for CSV handling, and browser-based OAuth authentication flows. - Sanitization: Absent; no explicit sanitization or validation logic is defined for the content retrieved from the external data providers before it is rendered into markdown or processed further.
Audit Metadata