vibe-domain-extractor

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill explicitly instructs the agent to identify and replace hardcoded secrets, API keys, and unhashed credentials during its analysis of legacy code, which promotes secure coding practices.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external prototype files as input. While it lacks explicit instructions to ignore embedded commands in those files, the specialized nature of the extraction workflow and the absence of dangerous automated execution patterns limit the risk surface to a low level.
  • Ingestion points: The agent reads project files and prototype code during the discovery phase (SKILL.md Step 1).
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions found within the code being analyzed.
  • Capability inventory: The skill uses Write to create files and has access to Bash for auditing, though no specific dangerous shell commands are defined in the instructions.
  • Sanitization: No explicit sanitization of the extracted content is mentioned before writing it back to the file system.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 08:07 PM
Security Audit — agent-trust-hub — vibe-domain-extractor