myvibe-publish
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes various system commands to manage its operations. It uses
npm installfor dependency management,gitfor repository metadata extraction, and spawnsnpx http-serverto serve local content for screenshots. It also executes theagent-browserutility for automated visual capture of the web content. - [EXTERNAL_DOWNLOADS]: Necessary utilities are retrieved from external sources. The skill installs the
agent-browserpackage from the NPM registry if it's not present and usesnpxto dynamically runhttp-server. These tools are standard for the skill's stated workflow. - [DATA_EXFILTRATION]: Project files and generated screenshots are uploaded to the MyVibe service (defaulting to
https://www.myvibe.so). This data transmission is the core functionality of the skill and occurs following a user confirmation step. - [CREDENTIALS_UNSAFE]: Authentication tokens are stored in the user's home directory (
~/.myvibe/myvibe-connected.yaml) using the@aigne/secretslibrary. This library attempts to utilize the system's secure keyring for storage, reducing the risk of unauthorized access to credentials.
Audit Metadata