vibe-prospecting

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill frequently uses the npx @vibeprospecting/vpai@latest command to perform prospecting tasks, such as fetching entities, enrichment, and statistics. This is the primary interface for the tool's functionality.
  • [EXTERNAL_DOWNLOADS]: The use of npx ensures that the latest version of the @vibeprospecting/vpai package is downloaded from the npm registry and executed at runtime. This is the intended delivery mechanism for the vendor's tool.
  • [DATA_EXFILTRATION]: The skill accesses a local configuration file at ~/.config/vpai/config.json to retrieve an API_KEY. This key is used to authenticate requests to the Explorium API. The instructions also include methods to write the key back to this location for persistence.
  • [REMOTE_CODE_EXECUTION]: A small Python script is executed via python3 -c to parse the JSON configuration file and extract the API key during the authentication sequence.
  • [PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of external company and professional data. While this creates a potential surface for indirect prompt injection, the instructions emphasize treating tool responses as JSON and presenting them in structured markdown tables, which provides some natural boundaries.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 07:27 PM