ecosystem
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches ecosystem statistics and metadata from the author's domain (vibeindex.ai) to populate the dashboard. This is legitimate vendor functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill reads external API data, which constitutes a potential injection surface. Ingestion points: External data is retrieved from vibeindex.ai API endpoints via WebFetch. Boundary markers: The agent is directed to format the output as a Markdown table. Capability inventory: The skill has no capabilities for file writing, shell execution, or sensitive data access. Sanitization: No explicit sanitization of external text is performed before display.
Audit Metadata