Skills
Navigate
skills/iblai/vibe/iblai-vibe-agent-setting/Gen Agent Trust Hub

iblai-vibe-agent-setting

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides a command to fetch an environment variable template (iblai.env) from the vendor's official GitHub repository.
  • Evidence: curl -o iblai.env https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/iblai.env in SKILL.md.
  • [COMMAND_EXECUTION]: The skill includes verification steps that execute standard development and testing tools.
  • Evidence: Usage of pnpm build, pnpm test, and npx playwright screenshot for component verification.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from URL parameters and local storage into the agent management UI.
  • Ingestion points: Reads mentorId from URL parameters in AgentSettingsLayout and userData/tenants from localStorage in AgentSettingsPage.
  • Boundary markers: None identified in the provided React code snippets.
  • Capability inventory: Component capabilities include navigation (router.push), UI state management, and logging.
  • Sanitization: No specific sanitization logic is demonstrated for the mentorId or localStorage data before interpolation into components.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 12:25 PM