iblai-vibe-agent-safety

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches an environment configuration template (iblai.env) from the vendor's official GitHub repository at github.com/iblai/vibe.
  • [COMMAND_EXECUTION]: Executes standard development commands including pnpm build, pnpm dev, and pnpm test for project setup and verification.
  • [COMMAND_EXECUTION]: Utilizes npx playwright to capture screenshots for visual verification of the safety tab.
  • [INDIRECT_PROMPT_INJECTION]:
    • Ingestion points: The AgentSafetyTab component accepts a renderPromptContent prop in app/(app)/agents/[mentorId]/safety/page.tsx which processes prompt content for display.
    • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are defined for the rendered markdown content.
    • Capability inventory: The skill environment supports shell command execution (pnpm, npx), file system writes (via curl -o), and network access.
    • Sanitization: The skill utilizes react-markdown for rendering but does not implement additional content sanitization or validation in the provided example.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 11:24 AM