iblai-vibe-api
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes shell commands in the 'The schema is the contract' section for verifying the platform's OpenAPI schema using
curlandgrep. These are provided as manual verification steps to be run by the developer or agent to ensure endpoint validity. - [INDIRECT_PROMPT_INJECTION]: The skill provides route handler templates that ingest external data (JSON bodies and search parameters) and perform actions like creating agents or sending notifications. It correctly implements a
requireAdminhelper to mitigate unauthorized access to these capabilities, ensuring that untrusted browser input is validated against the platform's session verification service. - [SAFE]: The skill communicates with the vendor's official domain (
api.iblai.app) and follows security best practices for credential management. It explicitly instructs the agent to keep theIBLAI_API_KEYon the server and never expose it to the browser viaNEXT_PUBLIC_prefixes.
Audit Metadata