iblai-vibe-monetization-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads environment configuration files (
iblai.env) and documentation from the vendor's official GitHub repository (raw.githubusercontent.com/iblai/vibe/...). It also fetches the OpenAPI schema from the vendor's API domain (api.iblai.app). These are legitimate vendor resources used for project initialization and validation. - [COMMAND_EXECUTION]: The skill uses standard shell commands and package managers (
pnpm,npm,npx,curl,grep,cut) to manage dependencies, verify API endpoints, and run development/test servers. These commands are typical for the described development workflow. - [INDIRECT_PROMPT_INJECTION]: The skill fetches a live OpenAPI schema to validate endpoint paths and methods. While this involves ingesting external data, the source is the vendor's own API, and the processing (via
grep) is limited to verifying structural metadata, presenting a negligible risk of prompt injection.
Audit Metadata