iblai-vibe-monetization-checkout
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads environment configuration files (
iblai.env) and brand guidelines (BRAND.md) from the vendor's official GitHub repository (github.com/iblai/vibe). - [COMMAND_EXECUTION]: Instructs the agent to run project build (
pnpm build) and development commands (pnpm dev) using thepnpmpackage manager, and to install UI components vianpx shadcn@latest. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests data from external API responses, specifically from
useCheckAccessQuery,useGetPublicPricingQuery, anduseCreateCheckoutMutationhooks (referenced inSKILL.mdandreferences/access-check.md). - Boundary markers: None explicitly defined for the data processed from these API hooks.
- Capability inventory: The skill performs browser redirects using
window.location.hrefbased on values returned from thecheckout_urlfield in API responses. - Sanitization: There is no explicit sanitization of the API-provided URLs before redirection, though the skill relies on the vendor's backend and SDK (
@iblai/iblai-js) to provide valid data.
Audit Metadata