iblai-vibe-agent-sandbox
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates shell command execution within a virtual machine sandbox environment as a core feature of the 'Virtual Machine Shell' runtime type.\n- [PERSISTENCE]: Installation involves appending configuration to the sandbox's
~/.bashrcfile to initialize environment variables (such asNODE_OPTIONS) and define logging helpers, ensuring security controls are active across sessions.\n- [DYNAMIC_EXECUTION]: A Node.js preload script (.nemoclaw-preload.js) is utilized to dynamically load security guard modules from the/tmpdirectory at runtime, implementing a fail-closed security policy for the agent's Node processes.\n- [EXTERNAL_DOWNLOADS]: The setup workflow includes instructions to download an environment configuration template directly from the vendor's official GitHub repository.\n- [INDIRECT_PROMPT_INJECTION]: The skill manages the editing and synchronization of agent prompt files (e.g.,AGENTS.md,SOUL.md) which form the agent's system prompt, constituting a surface for prompt interpolation. The instructions include explicit directives to the agent to avoid data exfiltration and follow safety guidelines.
Audit Metadata