vibelexity
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill's install and runtime instructions explicitly download and execute code from public third-party URLs (e.g., raw.githubusercontent.com / github.com clones and curl | bash to https://raw.githubusercontent.com/.../scripts/install-vibelexity.sh and https://astral.sh/uv/install.sh), so the agent would fetch and run untrusted public content as part of its workflow.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill includes a runtime branch that runs a remote installer via curl -fsSL https://raw.githubusercontent.com/ozozozd/vibelexity-claude-plugin/main/scripts/install-vibelexity.sh | bash when uvx is unavailable, which fetches and executes remote code and is relied on to provide the runtime tool, so it directly controls execution.
Audit Metadata