vibe-coding-advisor
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
curlto fetch UX principle data and prompts from the author's official domain (uxuiprinciples.com). These network operations are intended for retrieving the context data necessary for the skill's operation. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a prompt generator, processing user input and external API data to create system context for downstream AI agents. This is a characteristic of the skill's design rather than a malicious finding.
- Ingestion points: User-provided component descriptions and API responses from
uxuiprinciples.cominSKILL.md. - Boundary markers: None explicitly defined in the workflow for the generated context block.
- Capability inventory: Network operations via
curlused for API data retrieval. - Sanitization: None performed on user input or API content before inclusion in the final context block.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected. The use of an API key is standard for accessing the described professional tier services.
Audit Metadata