skills/iblai/vibe/iblai-vibe-profile/Gen Agent Trust Hub

iblai-vibe-profile

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves project templates and configuration files from the vendor's official GitHub repository.
  • Evidence: git clone --depth 1 https://github.com/iblai/vibe.git in Step 0.
  • Evidence: curl -o iblai.env https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/iblai.env in Step 1.
  • [COMMAND_EXECUTION]: The instructions require the execution of various shell commands for project setup, dependency management, and verification.
  • Evidence: pnpm install --ignore-scripts, pnpm build, pnpm test, and npx playwright screenshot.
  • [PROMPT_INJECTION]: The skill generates UI components that process user-controlled data (e.g., biographies, education history, and experience) fetched from localStorage or APIs, representing a surface for indirect prompt injection.
  • Ingestion points: Components read userData and tenants from localStorage in assets/profile-dropdown.tsx.j2 and the ProfilePage reference implementation.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the generated UI templates for user-provided data.
  • Capability inventory: The skill instructions include file writing and the generation of code that performs network operations and state management.
  • Sanitization: No specific sanitization or filtering of external content is mentioned before it is interpolated into the UI components.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 04:27 PM
Security Audit — agent-trust-hub — iblai-vibe-profile