iblai-vibe-profile
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download configuration templates and project starter files from the vendor's official GitHub repository (github.com/iblai/vibe). These resources are used for initial project scaffolding and configuration.
- [COMMAND_EXECUTION]: Includes standard shell commands for project initialization, such as
git clone,cp, andpnpm install, which are intended for local development setup. It specifically recommends using--ignore-scriptsduring package installation as a security best practice. - [INDIRECT_PROMPT_INJECTION]: Identifies an attack surface where user-provided metadata or profile information (e.g., bios, career history) could potentially contain instructions targeting the LLM during processing. This is a common surface for UI-driven agent skills and is managed by the vendor's SDK.
- Ingestion points: Reads
userDataandtenantsfromlocalStorage, and fetches profile data via platform APIs. - Boundary markers: Not explicitly defined in instructions; implementation is delegated to the @iblai/iblai-js SDK.
- Capability inventory: Uses network operations for API calls and file operations for local storage.
- Sanitization: Relies on the vendor's SDK for data handling and presentation.
Audit Metadata