vibeflow-router
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to run several local Python scripts, including 'get-vibeflow-phase.py' and 'get-vibeflow-paths.py', to determine the current workflow phase and handle artifact paths.
- [REMOTE_CODE_EXECUTION]: The 'hook-integration.md' reference describes a system of 'Session Start Hooks' (.vibeflow/hooks/session-start.sh and .vibeflow/hooks/session-start.ps1) that are executed at the start of every session. This provides a vector for arbitrary shell command execution.
- [EXTERNAL_DOWNLOADS]: Example hook configurations provided in the skill instructions include 'git pull' commands, which involve fetching code updates from remote repositories.
- [PROMPT_INJECTION]: The skill ingests untrusted data from files including '.vibeflow/state.json', 'feature-list.json', and '.vibeflow/increments/queue.json' (Ingestion points) without explicit sanitization (Sanitization absent) or boundary markers (Boundary markers absent). Given the skill's capability to execute shell scripts and Python code (Capability inventory), this represents an indirect prompt injection surface where malicious data in the project files could influence agent behavior or command parameters.
Audit Metadata