vibers-code-review

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure a GitHub Action (marsiandeployer/vibers-action@v1) which downloads and executes code from a third-party repository during the CI/CD process.
  • [DATA_EXFILTRATION]: The skill includes a feedback mechanism that sends the repository URL and user-provided messages to an external endpoint (https://vibers.onout.org/feedback) via a curl command.
  • [COMMAND_EXECUTION]: The documentation provides a shell command (curl) to be executed by the agent or user to transmit data to the service's backend.
  • [INDIRECT_PROMPT_INJECTION]: The workflow establishes a feedback loop where an external service (Vibers) submits Pull Requests that the AI agent is then expected to review and merge. This creates a surface where external actors can provide instructions that the agent may follow during the PR review process.
  • Ingestion points: Pull Request content and commit messages generated by the marsiandeployer account.
  • Boundary markers: None specified; the agent is instructed to "review the PR, merge or comment" without explicit instructions to disregard embedded commands in the PR body.
  • Capability inventory: The agent has the capability to read files, comment on PRs, and potentially merge code depending on its broader toolset.
  • Sanitization: No sanitization or validation of the PR content is described before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 06:54 AM