iblai-vibe-profile
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves project templates and configuration files from the vendor's official GitHub repository.
- Evidence:
git clone --depth 1 https://github.com/iblai/vibe.gitin Step 0. - Evidence:
curl -o iblai.env https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/iblai.envin Step 1. - [COMMAND_EXECUTION]: The instructions require the execution of various shell commands for project setup, dependency management, and verification.
- Evidence:
pnpm install --ignore-scripts,pnpm build,pnpm test, andnpx playwright screenshot. - [PROMPT_INJECTION]: The skill generates UI components that process user-controlled data (e.g., biographies, education history, and experience) fetched from
localStorageor APIs, representing a surface for indirect prompt injection. - Ingestion points: Components read
userDataandtenantsfromlocalStorageinassets/profile-dropdown.tsx.j2and theProfilePagereference implementation. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the generated UI templates for user-provided data.
- Capability inventory: The skill instructions include file writing and the generation of code that performs network operations and state management.
- Sanitization: No specific sanitization or filtering of external content is mentioned before it is interpolated into the UI components.
Audit Metadata