vercel-supabase-launch-check
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and runs the
viberavenpackage from the npm registry using thenpxcommand at runtime. - Evidence:
npx -y viberaven@1.6.1 checkin SKILL.md. - [COMMAND_EXECUTION]: The skill executes shell commands to perform security audits and apply code fixes to the local repository.
- Evidence: Commands like
viberaven_check_readiness,npx -y viberaven@1.6.1 fix, andnpx -y viberaven@1.6.1 auditare used to interact with the project environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from a local file generated by the tool, which could potentially contain untrusted content if the repository being scanned is malicious.
- Ingestion points: Terminal output and
.viberaven/agent-tasklist.md(SKILL.md). - Boundary markers: None explicitly defined to separate tool output from instructions.
- Capability inventory: Shell execution via
npxand file writing capability for fixing gaps. - Sanitization: Not specified; relies on the agent's interpretation of findings.
Audit Metadata