iblai-vibe-ops-init
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill installs the Anthropic frontend design skill from its official GitHub repository to provide UI guidance. This targets a trusted repository and is documented as a standard feature of the setup process.
- [EXTERNAL_DOWNLOADS]: During the initialization process, the skill can clone the vendor's own repository (
iblai/vibe) to retrieve project templates if local assets are unavailable. These resources originate from the skill's official author. - [COMMAND_EXECUTION]: The skill automates project bootstrapping through shell commands, including directory structure creation, Git initialization, and dependency management. It utilizes
pnpm install --ignore-scriptsto mitigate potential supply chain attacks from malicious post-install scripts. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requests ibl.ai platform credentials and stores them in local environment files (
.env.localandiblai.env). This is standard behavior for development tools, and there is no evidence of these tokens being transmitted to unauthorized external domains.
Audit Metadata