iblai-vibe-security-dependency-audit
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various system commands via the Bash tool to perform security audits. These include
npm audit,pip audit,safety check,bundle audit,govulncheck,cargo audit,composer audit,dotnet list package --vulnerable,docker scout, andtrivy. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data from project manifest and configuration files, creating a surface for indirect prompt injection if those files contain malicious instructions aimed at the agent.
- Ingestion points: The skill reads several manifest files including
package.json,requirements.txt,Gemfile,go.mod,pom.xml, and.envfiles. - Boundary markers: There are no explicit instructions or delimiters defined to separate the untrusted file content from the agent's instructions.
- Capability inventory: The agent has access to
Bash,Read,Write, andWebSearchtools, allowing it to perform actions based on the parsed data. - Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from the audited files before it is processed or used in subsequent tool calls.
Audit Metadata