vibe-security-skill
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied code for auditing, representing an ingestion point for untrusted data. Ingestion points: User source code provided for analysis. Boundary markers: None specified in the instructions. Capability inventory: Limited to analysis and advisory; no destructive or exfiltrative capabilities are present. Sanitization: No explicit sanitization or validation for the audited code is described.
- [CREDENTIALS_UNSAFE]: The documentation includes dummy API key fragments and JWT headers (e.g., 'sk-proj-...') as examples of 'Bad Patterns' to educate users on insecure coding practices.
- [SAFE]: The skill serves as a protective utility and does not execute remote code, exfiltrate data, or perform unauthorized operations.
Audit Metadata