iblai-marketing-landing
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
pnpm devandpnpm buildfor development and verification, and usesnpx shadcn@latestto install UI components. - [EXTERNAL_DOWNLOADS]: Fetches design assets, brand guidelines (BRAND.md), and UI blocks from the author's repository at
github.com/iblai/vibeand the official shadcn registry. - [REMOTE_CODE_EXECUTION]: Utilizes
npx shadcn@latestto download and integrate external code blocks into the local project, which is a standard development workflow for this tool. - [PROMPT_INJECTION]: The skill processes untrusted data from the local codebase (e.g., README, App Store metadata) and user-provided answers to generate landing page content. While this creates an indirect prompt injection surface, it is inherent to the skill's purpose as a code generator and no malicious intent was observed.
- Ingestion points: Reads
CLAUDE.md,README, and user answers to discovery questions. - Boundary markers: None identified.
- Capability inventory: File system writes, shell execution via
pnpmandnpx. - Sanitization: None identified; the skill relies on the agent's ability to translate input into JSX components.
Audit Metadata