vibe-domain-extractor
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill explicitly instructs the agent to identify and replace hardcoded secrets, API keys, and unhashed credentials during its analysis of legacy code, which promotes secure coding practices.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external prototype files as input. While it lacks explicit instructions to ignore embedded commands in those files, the specialized nature of the extraction workflow and the absence of dangerous automated execution patterns limit the risk surface to a low level.
- Ingestion points: The agent reads project files and prototype code during the discovery phase (SKILL.md Step 1).
- Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions found within the code being analyzed.
- Capability inventory: The skill uses
Writeto create files and has access toBashfor auditing, though no specific dangerous shell commands are defined in the instructions. - Sanitization: No explicit sanitization of the extracted content is mentioned before writing it back to the file system.
Audit Metadata