fork
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for the official vibedgames CLI tool to manage project lifecycles. No malicious patterns, obfuscation, or unauthorized access attempts were identified.- [EXTERNAL_DOWNLOADS]: The
vg forkcommand downloads source archives from the official vibedgames.com domain. This is a core, intended feature for collaborative development and code sharing.- [DYNAMIC_EXECUTION]: The workflow involves standard project setup and build operations usingnpm installandnpm runon local project files, which is expected behavior for Node.js developer tools.- [DATA_EXFILTRATION]: Thevg deploy --sourcecommand allows users to opt-in to sharing their source code. The platform mitigates accidental data exposure by automatically excluding common secret files and credentials (e.g., SSH keys, .env files) from the uploaded archive.- [INDIRECT_PROMPT_INJECTION]: While the skill involves processing external source archives viavg fork, the risk is categorized as safe due to built-in platform safeguards and the developer-centric use case. (1) Ingestion point:vg forkdownloads external source archives. (2) Boundary markers: The skill relies on standard project structure and user intent rather than explicit prompt delimiters. (3) Capability inventory: CLI commands for file management, dependency installation, and network deployment. (4) Sanitization: Automatic exclusion of sensitive file patterns during the archival process.
Audit Metadata