iblai-vibe-component
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads project templates, environment configurations, and brand guidelines from the official ibl.ai GitHub repository (
github.com/iblai/vibe). - [COMMAND_EXECUTION]: Orchestrates project setup using standard CLI utilities including
git,pnpm,npx, andcpfor directory copying and package management. - [REMOTE_CODE_EXECUTION]: Instructs the use of the
--ignore-scriptsflag duringpnpm installto prevent the execution of potentially malicious lifecycle scripts in dependencies. - [CREDENTIALS_UNSAFE]: References the use of a configuration file (
iblai.env) to manage platform tokens and identifiers, but follows standard practices by instructing users to fill these in locally rather than hardcoding them. - [PROMPT_INJECTION]: The skill analyzes local project files (e.g.,
components.json,tailwind.config.js,globals.css) to adapt its output to existing design systems. While this creates a surface for indirect prompt injection, it is used here for legitimate context-aware code generation.
Audit Metadata