iblai-vibe-agent-task
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download an environment configuration template (
iblai.env) from the vendor's official GitHub repository (github.com/iblai/vibe) usingcurl. This is a standard setup procedure for this vendor's tools. - [INDIRECT_PROMPT_INJECTION]: The skill implements a UI for scheduling agent tasks that includes a 'Task Prompt' input field. This creates an attack surface where untrusted user input (the prompt) is stored and later processed by an agent. However, this is the intended primary purpose of the skill for scheduling automated tasks.
- Ingestion points: 'Task Prompt' field in the 'Schedule Task' dialog component described in the 'Tab surfaces' section.
- Boundary markers: None explicitly defined in the UI snippets; the component is a high-level SDK wrapper.
- Capability inventory: The component handles data fetching and mutations for task lifecycle management (list, create, delete, run logs) via the
@iblai/iblai-jsSDK. - Sanitization: Sanitization is handled internally by the vendor's SDK components.
Audit Metadata