skills/randroids-dojo/skills/vibekit/Gen Agent Trust Hub

vibekit

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell scripts and Node.js commands to manage project dependencies.
  • The /vibekit add command runs scripts/add.sh, which uses node to safely parse and update the project's package.json file.
  • It also invokes standard package managers (npm, yarn, or pnpm) to refresh the lockfile after updating dependencies.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub APIs and repositories to resolve version tags and install the library.
  • The add.sh script uses the gh CLI to fetch the latest release tag from github.com/Randroids-Dojo/VibeKit.
  • It pins the dependency using the github: protocol, which is a standard feature for installing packages directly from GitHub.
  • These operations target the vendor's own infrastructure and are consistent with the skill's primary purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 08:48 PM