project-blueprint
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (LOW): The skill instructs the agent to execute
npx vibery listandnpx vibery searchto dynamically fetch component metadata. This relies on the npm registry to execute the 'vibery' package. - [EXTERNAL_DOWNLOADS] (LOW): The skill is designed to generate installation recipes that download third-party agents, MCPs, and hooks from an external ecosystem (Vibery).
- [DATA_EXPOSURE] (LOW): The skill accesses local project manifest files such as
package.json,requirements.txt,go.mod, andCargo.tomlto identify the current development environment. This behavior is necessary for its stated purpose but constitutes file system access. - [INDIRECT_PROMPT_INJECTION] (LOW):
- Ingestion points: Reads content from
package.json,requirements.txt,go.mod, andCargo.toml. - Boundary markers: None present; the agent treats the content of these files as factual input for tech stack classification.
- Capability inventory: Can execute
npxshell commands and write configuration files likeCLAUDE.md. - Sanitization: None; the skill assumes these files are standard package manifests.
Audit Metadata