iblai-vibe-monetization-analytics
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a YAML schema file from the vendor's official API (
https://api.iblai.app/dm/api/docs/schema/) and configuration files from the vendor's GitHub repository (https://raw.githubusercontent.com/iblai/vibe/). These are legitimate vendor resources used for environment setup and verification. - [COMMAND_EXECUTION]: Standard development commands such as
pnpm dev,pnpm build, andgrepare used for project initialization and verification. The use ofcurlto fetch the API schema followed bygrepis an informative step to confirm endpoint availability rather than an execution of remote code. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing data from external API endpoints (subscribers, revenue, paywalls) and user-supplied item identifiers. While this introduces a surface for indirect prompt injection, the risk is minimized by the use of structured data (JSON) and the fact that ingestion points are controlled by the vendor's own infrastructure.
- [SAFE]: The identified 'iblai' vendor resources (domains, GitHub repositories, and NPM packages) are consistent with the skill's stated purpose and author identity, representing normal functional dependencies.
Audit Metadata