iblai-vibe-ops-init
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads project assets and templates from the vendor's repository (
github.com/iblai/vibe.git) and installs thefrontend-designskill from a trusted repository (github.com/anthropics/skills). These resources are from the skill vendor and a trusted organization respectively. - [COMMAND_EXECUTION]: The skill performs various filesystem and network operations using standard CLI tools like
cp,git,curl, andpnpmto scaffold the project and verify credentials. These actions are aligned with the skill's stated purpose of project initialization. - [REMOTE_CODE_EXECUTION]: The skill executes package installation via
pnpm installand adds external skills usingnpx. It mitigates potential risks by explicitly using the--ignore-scriptsflag during installation and sourcing skills from trusted repositories. - [CREDENTIALS_SAFE]: The skill manages Platform API tokens by securely prompting the user for input and writing the values to local environment files (
.env.localandiblai.env). It includes specific instructions for the agent to mask sensitive tokens and avoid echoing them back into the chat interface.
Audit Metadata