vibe-prospecting
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently uses the
npx @vibeprospecting/vpai@latestcommand to perform prospecting tasks, such as fetching entities, enrichment, and statistics. This is the primary interface for the tool's functionality. - [EXTERNAL_DOWNLOADS]: The use of
npxensures that the latest version of the@vibeprospecting/vpaipackage is downloaded from the npm registry and executed at runtime. This is the intended delivery mechanism for the vendor's tool. - [DATA_EXFILTRATION]: The skill accesses a local configuration file at
~/.config/vpai/config.jsonto retrieve anAPI_KEY. This key is used to authenticate requests to the Explorium API. The instructions also include methods to write the key back to this location for persistence. - [REMOTE_CODE_EXECUTION]: A small Python script is executed via
python3 -cto parse the JSON configuration file and extract the API key during the authentication sequence. - [PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of external company and professional data. While this creates a potential surface for indirect prompt injection, the instructions emphasize treating tool responses as JSON and presenting them in structured markdown tables, which provides some natural boundaries.
Audit Metadata