iblai-vibe-agent-evals
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads environment configuration templates and documentation from the vendor's official GitHub repository. Evidence:
curl -o iblai.env https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/iblai.envand documentation links toraw.githubusercontent.com/iblai/vibe. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-supplied benchmarks which is then evaluated by an LLM-as-Judge. 1. Ingestion points: CSV uploads and manual Q&A input forms documented in SKILL.md. 2. Boundary markers: Absent; there are no instructions to delimit benchmark content from evaluation instructions. 3. Capability inventory: REST API calls to vendor endpoints and external LLM providers (OpenAI, Anthropic, Google) as documented in the evaluation workflow in SKILL.md. 4. Sanitization: Absent; no specific sanitization of benchmark content is described before LLM evaluation.
- [COMMAND_EXECUTION]: Includes verification steps that utilize standard developer tools for testing and deployment. Evidence: Instructions in SKILL.md to run
pnpm build,pnpm test, andnpx playwright screenshotfor verifying the integration.
Audit Metadata