versus
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from the developer's API at vibeindex.ai to retrieve resource metadata for side-by-side comparisons.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external API and the local package.json file, which presents a surface for indirect prompt injection. 1. Ingestion points: API responses from vibeindex.ai and local package.json content. 2. Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the skill definition. 3. Capability inventory: The skill utilizes network access via WebFetch and local file system read access for the package.json file. 4. Sanitization: No evidence of sanitization or validation of the fetched data is provided before the agent processes it for recommendations.
Audit Metadata