vlmkit
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a setup script (doctor.sh) from the author's GitHub repository (raw.githubusercontent.com/mizchi/skills).
- [REMOTE_CODE_EXECUTION]: The recommended pre-flight check involves executing a remote script via bash process substitution (bash <(curl ...)). Review of the doctor.sh script shows it is restricted to environment verification (Node.js version, package manager presence, Playwright installation status, and API key availability) without performing any unsafe operations.
- [COMMAND_EXECUTION]: The skill utilizes several local CLI tools including pnpm, npx playwright, and the @mizchi/vlmkit suite for visual auditing and snapshotting.
- [PROMPT_INJECTION]: The skill processes untrusted inputs such as URLs, HTML code, and screenshots via VLM and LLM feedback loops. This constitutes an indirect prompt injection surface.
- Ingestion points: The skill reads external URLs and HTML/CSS files as specified in SKILL.md.
- Boundary markers: There are no explicit delimiters or instructions provided to ignore potentially malicious embedded content in the ingested data.
- Capability inventory: The skill performs file system writes to output directories and controls browser instances via Playwright.
- Sanitization: No evidence of input validation or sanitization for the processed markup was found.
Audit Metadata