vibehost-deploy
Fail
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The setup instructions include a command (
curl -fsSL https://vibehost.com/install.sh | sh) that downloads a script from a remote server and pipes it directly into the system shell. This pattern is highly risky as it executes unverified code with the permissions of the current user. - [EXTERNAL_DOWNLOADS]: The skill is designed to download installation binaries and interact with remote services at
vibehost.comandapi.vibehost.comwhich are not pre-verified or whitelisted domains. - [COMMAND_EXECUTION]: The skill relies on several shell commands (
vibehost login,vibehost deploy,vibehost whoami) to function. While these are necessary for the CLI tool, they represent a broad attack surface if the agent is manipulated into executing unintended arguments. - [DATA_EXFILTRATION]: The primary function of the skill is to read local files from build directories (e.g.,
dist/,build/) and upload them to an external server (api.vibehost.com). While this is the intended purpose for deployment, it involves the transmission of local project data to a third-party service.
Recommendations
- HIGH: Downloads and executes remote code from: https://vibehost.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata