iblai-vibe-application

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a form wizard (ApplyWizard) and an administrative reviewer workspace (Admin) that ingest data from external applicants. This creates a surface for indirect prompt injection where malicious data provided by an applicant could attempt to influence the agent when it summarizes or processes applications.
  • Ingestion points: Applicant-submitted form data processed by ApplyWizard and viewed in Admin reviewer workspace.
  • Boundary markers: None explicitly defined in the instructions; logic relies on the @iblai/iblai-js library's internal handling.
  • Capability inventory: The skill provides instructions for executing shell commands (pnpm, npx) and performing network mutations via the data-layer hooks.
  • Sanitization: Not explicitly documented in the setup; assumes the underlying SDK handles data safely.
  • [EXTERNAL_DOWNLOADS]: Fetches an environment variable template from the official iblai GitHub repository using curl.
  • [COMMAND_EXECUTION]: Instructs the agent to run local commands to verify package contents using grep and perform standard build and testing steps using pnpm and npx.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 11:25 AM