vibekit
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts and Node.js commands to manage project dependencies.
- The
/vibekit addcommand runsscripts/add.sh, which usesnodeto safely parse and update the project'spackage.jsonfile. - It also invokes standard package managers (
npm,yarn, orpnpm) to refresh the lockfile after updating dependencies. - [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub APIs and repositories to resolve version tags and install the library.
- The
add.shscript uses theghCLI to fetch the latest release tag fromgithub.com/Randroids-Dojo/VibeKit. - It pins the dependency using the
github:protocol, which is a standard feature for installing packages directly from GitHub. - These operations target the vendor's own infrastructure and are consistent with the skill's primary purpose.
Audit Metadata