vibecode-production-qa-validator
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by instructing the agent to fetch and process data from external production URLs.
- Ingestion points: The skill uses
curlto fetch status codes and metadata from a user-definedPROD_URLand its sub-routes. - Boundary markers: No explicit boundary markers or instructions to ignore embedded malicious content are present in the scripts used to process external responses.
- Capability inventory: The skill possesses the capability to execute shell commands (
curl,npm,npx), access the local file system for build and test processes, and perform network operations. - Sanitization: There is no evidence of sanitization or filtering applied to the external content retrieved from the web before it is processed by the agent.
Audit Metadata