skills/kyh/vibedgames/deploy/Gen Agent Trust Hub

deploy

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill manages the project lifecycle by executing shell commands such as npm install, npm run build, and the vendor-specific vg CLI tool. These are expected behaviors for a deployment and build automation skill.
  • [EXTERNAL_DOWNLOADS]: The vg new --template command allows the agent to fetch project templates from GitHub repositories. GitHub is a well-known service for source code hosting.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project data to determine configuration settings, which presents a surface for indirect prompt injection.
  • Ingestion points: The skill reads package.json, vibedgames.json, and the project's directory structure (e.g., checking for index.html) to configure its behavior.
  • Boundary markers: No specific delimiters or "ignore instructions" markers are used when reading these project configuration files.
  • Capability inventory: The skill possesses capabilities for file system access, execution of build scripts via npm/npx, and network communication via the deployment CLI.
  • Sanitization: There is no explicit sanitization of the values read from vibedgames.json before they are used as arguments (e.g., the --slug parameter).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:16 AM