iblai-vibe-agent-skills
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages agent 'Instructions' (playbooks) through a RichTextEditor in the user interface. This creates a potential attack surface where malicious instructions could be embedded into a skill definition.
- Ingestion points: The 'Instruction' field within the New/Edit Skill dialog described in SKILL.md.
- Boundary markers: The documentation does not specify the use of prompt delimiters or instructions to ignore embedded content within these fields.
- Capability inventory: These instructions are intended to be executed by 'Base Agents' which possess a wide range of autonomous capabilities.
- Sanitization: There is no mention of sanitization, validation, or filtering processes for the content of these instructions.
- [EXTERNAL_DOWNLOADS]: The skill recommends downloading an environment configuration template from the vendor's official repository (raw.githubusercontent.com/iblai/vibe). This download is performed from a trusted vendor source.
Audit Metadata