iblai-vibe-application
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a form wizard (
ApplyWizard) and an administrative reviewer workspace (Admin) that ingest data from external applicants. This creates a surface for indirect prompt injection where malicious data provided by an applicant could attempt to influence the agent when it summarizes or processes applications. - Ingestion points: Applicant-submitted form data processed by
ApplyWizardand viewed inAdminreviewer workspace. - Boundary markers: None explicitly defined in the instructions; logic relies on the
@iblai/iblai-jslibrary's internal handling. - Capability inventory: The skill provides instructions for executing shell commands (
pnpm,npx) and performing network mutations via the data-layer hooks. - Sanitization: Not explicitly documented in the setup; assumes the underlying SDK handles data safely.
- [EXTERNAL_DOWNLOADS]: Fetches an environment variable template from the official
iblaiGitHub repository usingcurl. - [COMMAND_EXECUTION]: Instructs the agent to run local commands to verify package contents using
grepand perform standard build and testing steps usingpnpmandnpx.
Audit Metadata