iblai-vibe-org-metadata
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The documentation suggests a verification command that pipes the results of a
curlrequest topython3 -m json.tool. This is a standard administrative utility used to format JSON data for readability and does not represent an execution of untrusted remote code. The target domain is a placeholder for the official platform API. - [INDIRECT_PROMPT_INJECTION]: The skill manages organization-wide configuration data (such as welcome messages) that is retrieved at runtime. This creates a potential surface for indirect injection; however, the skill mitigates this by enforcing that only organization admins have write access and by providing explicit documentation that this data is public and must not contain secrets.
- [EXTERNAL_DOWNLOADS]: UI assets, images, and supplementary documentation are referenced from the official GitHub repository of the vendor (
iblai). These resources are used strictly for documentation and skill presentation purposes.
Audit Metadata