iblai-vibe-ops-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to build and deploy applications, including pnpm build and npx vercel deploy as part of its primary deployment functionality.
  • [DATA_EXFILTRATION]: The skill synchronizes local environment variables from .env.local to Vercel's infrastructure. While this involves sending project configuration to a remote server, it is directed to a well-known service provider as part of the intended deployment process.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the official Vercel CLI from a well-known service registry.
  • [PROMPT_INJECTION]: The skill processes project configuration files which could serve as a surface for indirect prompt injection if those files are controlled by an untrusted party.
  • Ingestion points: next.config, .env.local, and tauri.conf.json (referenced in SKILL.md and deploy-command.md).
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content are used when reading these files.
  • Capability inventory: Shell command execution (pnpm, npx), file system modification (vercel.json, .env), and Vercel API network operations.
  • Sanitization: No specific sanitization or validation of the content of these configuration files is described before they influence agent behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 04:26 PM
Security Audit — agent-trust-hub — iblai-vibe-ops-deploy