iblai-vibe-agent-sandbox

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates shell command execution within a virtual machine sandbox environment as a core feature of the 'Virtual Machine Shell' runtime type.\n- [PERSISTENCE]: Installation involves appending configuration to the sandbox's ~/.bashrc file to initialize environment variables (such as NODE_OPTIONS) and define logging helpers, ensuring security controls are active across sessions.\n- [DYNAMIC_EXECUTION]: A Node.js preload script (.nemoclaw-preload.js) is utilized to dynamically load security guard modules from the /tmp directory at runtime, implementing a fail-closed security policy for the agent's Node processes.\n- [EXTERNAL_DOWNLOADS]: The setup workflow includes instructions to download an environment configuration template directly from the vendor's official GitHub repository.\n- [INDIRECT_PROMPT_INJECTION]: The skill manages the editing and synchronization of agent prompt files (e.g., AGENTS.md, SOUL.md) which form the agent's system prompt, constituting a surface for prompt interpolation. The instructions include explicit directives to the agent to avoid data exfiltration and follow safety guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 10:37 AM