iblai-marketing-landing

Pass

Audited by Gen Agent Trust Hub on Aug 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use pnpm dev and pnpm build for development and verification, and uses npx shadcn@latest to install UI components.
  • [EXTERNAL_DOWNLOADS]: Fetches design assets, brand guidelines (BRAND.md), and UI blocks from the author's repository at github.com/iblai/vibe and the official shadcn registry.
  • [REMOTE_CODE_EXECUTION]: Utilizes npx shadcn@latest to download and integrate external code blocks into the local project, which is a standard development workflow for this tool.
  • [PROMPT_INJECTION]: The skill processes untrusted data from the local codebase (e.g., README, App Store metadata) and user-provided answers to generate landing page content. While this creates an indirect prompt injection surface, it is inherent to the skill's purpose as a code generator and no malicious intent was observed.
  • Ingestion points: Reads CLAUDE.md, README, and user answers to discovery questions.
  • Boundary markers: None identified.
  • Capability inventory: File system writes, shell execution via pnpm and npx.
  • Sanitization: None identified; the skill relies on the agent's ability to translate input into JSX components.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 2, 2026, 01:37 PM
Security Audit — agent-trust-hub — iblai-marketing-landing