iblai-vibe-security-cloud-audit
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands via the
Bashtool to interact with AWS, GCP, and Azure CLI utilities. These commands retrieve sensitive infrastructure configuration, including IAM credential reports, project policies, and storage access blocks. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted external data from cloud resource configurations and Infrastructure-as-Code (IaC) files.
- Ingestion points: Reads Terraform, CloudFormation, and Pulumi files from the local filesystem, as well as metadata returned by cloud provider APIs.
- Boundary markers: The instructions include scoping guidance and boundaries to limit the audit to authorized accounts, though these do not prevent adversarial injection within the data being audited.
- Capability inventory: The skill has access to tools for file operations (
Read,Write,Grep,Glob) and command execution (Bash). - Sanitization: There is no explicit mechanism defined to sanitize or escape the content of the files or API responses before they are processed by the agent.
Audit Metadata