iblai-vibe-ops-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches release metadata and changelog information from the official vendor repository at
api.github.com/repos/iblai/vibeandraw.githubusercontent.com/iblai/vibe. These are trusted sources owned by the skill author. - [REMOTE_CODE_EXECUTION]: Automated scanners flagged the use of
curl ... | python3 -c. Analysis confirms this is a safe pattern used for JSON parsing of the release data. The Python logic is hardcoded within the skill and does not execute remote scripts. - [COMMAND_EXECUTION]: The skill uses
sed,node, andnpm/pnpmto modify local configuration files (package.json,pnpm-workspace.yaml). These actions are limited to upgrading vendor-specific dependencies and removing obsolete configuration overrides. - [REMOTE_CODE_EXECUTION]: The skill runs
npx skills add iblai/vibe --all. This is the standard method for installing and updating agent skills from the vendor's repository.
Audit Metadata