iblai-vibe-agent-chat
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration adds several Node.js dependencies required for the chat interface and its supporting features. These include official ibl.ai SDK packages such as @iblai/data-layer, @iblai/web-containers, @iblai/web-utils, and @iblai/agent-ai. It also includes well-known third-party libraries for UI components, voice communications, and desktop integration, such as react-paginate, livekit-client, and @tauri-apps/api.
- [INDIRECT_PROMPT_INJECTION]: As a chat interface component, the skill provides a surface for processing untrusted external data such as user messages and file attachments. Ingestion points: The Chat component input field and file attachment handlers in app/agents/[mentorId]/chat-new/page.tsx. Boundary markers: The integration relies on the underlying SDK to handle message delimitation and context separation. Capability inventory: The agent surface supports message streaming, file processing, voice calls, and screen sharing via the provided UI components. Sanitization: Sanitization and safety filtering are handled by the core ibl.ai agent services integrated via the SDK.
- [SAFE]: The skill manages authentication tokens and user identifying information from local storage and environment variables to facilitate secure communication with backend agent services. This is standard and necessary behavior for an authenticated chat interface. All external resource references point to official vendor infrastructure.
Audit Metadata